What is the CVSS score of CVE-2026-5422?

CVE-2026-5422 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Jupyter Server are affected by CVE-2026-5422?

Jupyter Server 2.17.0 contains a path traversal vulnerability enabling unauthorized access to files outside the configured scope, with publicly available exploit code disclosed.. A patch is available.

How to fix or mitigate CVE-2026-5422?

Within 24 hours: Identify all Jupyter Server 2.17.0 instances, particularly in multi-tenant configurations; restrict network access to trusted sources only; review recent access logs for suspicious directory traversal patterns. Within 7 days: Implement file system restrictions (strict directory ACLs limiting process to configured root only); enable comprehensive file access auditing; isolate affected instances from other critical systems. Within 30 days: Apply vendor patch upon release; conduct forensic audit for exploitation evidence; upgrade all instances to patched version.

Jupyter Server CVE-2026-5422

EUVD-2026-33905 HIGH

Relative Path Traversal (CWE-23)

2026-06-02 @huntr_ai

GHSA-gf7q-q4j7-hp7c

Information Disclosure Path Traversal Jupyter Jupyter Jupyter

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SUSE

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Red Hat

6.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 17:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 17:22 vuln.today

cvss_changed

Severity Changed

Jun 03, 2026 - 17:22 NVD

MEDIUM HIGH

CVSS changed

Jun 03, 2026 - 17:22 NVD

6.8 (MEDIUM) 8.1 (HIGH)

Analysis Generated

Jun 02, 2026 - 10:20 vuln.today

DescriptionNVD

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

AnalysisAI

Path traversal in Jupyter Server 2.17.0 allows authenticated users to read and write files in sibling directories outside the configured root, via a flawed startswith() boundary check in _get_os_path() combined with to_os_path() failing to strip '..' sequences. With CVSS 8.1 (high confidentiality and integrity impact) and a publicly available proof-of-concept disclosed through huntr, the issue is particularly dangerous in shared/multi-tenant hosting where multiple Jupyter instances share a parent directory. EPSS is currently low (0.05%), and there is no public exploit identified at time of analysis beyond the huntr POC reference.

Technical ContextAI

Jupyter Server is the backend that powers JupyterLab, Jupyter Notebook, and Voila, exposing an HTTP/WebSocket API to manage notebook files and kernels. The vulnerability is a CWE-23 (Relative Path Traversal) caused by two interacting bugs in the contents service: jupyter_server/services/contents/fileio.py uses path.startswith(root) without appending os.sep, so a configured root_dir like '/srv/notebooks' matches sibling directories such as '/srv/notebooks-admin', and jupyter_server/utils.py's to_os_path() does not normalize or strip '..' segments, so URL-supplied path components are joined verbatim before the flawed boundary check. The result is that the sandbox intended to constrain file operations to root_dir can be escaped through prefix-collision sibling directories combined with relative traversal.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - monitor the huntr bounty page (https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f), the jupyter-server GitHub releases/security advisories, and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-5422) for a fixed version above 2.17.0 and upgrade as soon as it ships. As compensating controls until a patch lands, ensure each Jupyter Server instance's root_dir has no sibling directories sharing a name prefix (e.g., rename '/srv/notebooks-admin' so it cannot match '/srv/notebooks' via startswith), or place each user's root_dir inside its own dedicated parent with no siblings - the trade-off is operational/storage layout changes. Additionally, restrict accounts that can authenticate to the contents API on shared hosts (since PR:L is required), run each tenant under a separate OS user with filesystem ACLs that deny cross-tenant reads/writes regardless of application-layer checks, and front the server with an authenticating reverse proxy to limit who can reach the API; the side effect is added auth/proxy operational overhead but it materially reduces blast radius.