CVE-2026-108258: Shiny for Python has path traversal in bookmark restore

Shiny for Python’s bookmark-restore path accepted a client-supplied _state_id_ query-string value and joined it into the server-side bookmark directory (<cwd>/shiny_bookmarks/<id>) without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open and parse input.json and values.json from a directory outside the bookmark store.

On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (bookmark_store="disable") — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names.

Applications configured with bookmark_store="server" and using ui.input_file() are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application.