EUVD-2026-33905
GHSA-gf7q-q4j7-hp7c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Jupyter Server with low-privilege account
-
DeliveryEnumerate sibling directories sharing root_dir prefix
-
ExploitCraft contents API path with prefix collision or '..' segments
-
ExecutionBypass _get_os_path startswith check
-
PersistRead or write files in sibling tenant directory
-
ImpactExfiltrate notebooks, tokens, or overwrite configs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
|
| Exploitation Conditions | Exploitation requires (1) network reachability to a Jupyter Server 2.17.0 instance's contents API, (2) valid low-privilege credentials on that server (CVSS PR:L), and (3) a filesystem layout where the configured root_dir has a sibling directory whose name shares its prefix (e.g., root_dir '/data/user1' alongside '/data/user1-shared'), or a deployment where attacker-controlled path components can include '..' segments that to_os_path() forwards unstripped. No user interaction is required (UI:N) and integrity/availability of other tenants' files is at risk only when those files live in such prefix-colliding siblings of root_dir - a single-tenant deployment with a uniquely named, isolated root_dir significantly limits practical exploitation. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N captures the practical risk well: network-reachable, low complexity, requires only a low-privilege authenticated session, no user interaction, and yields high confidentiality and integrity impact with unchanged scope. SSVC reinforces this with Exploitation=POC, Automatable=No, and Technical Impact=Total, indicating known exploit code but not yet a worm-grade automatable threat. EPSS at 0.05% (14th percentile) is low, and the CVE is not in CISA KEV, so this is best characterized as a credible, targetable issue for multi-tenant Jupyter deployments rather than a mass-exploitation emergency. One inconsistency to flag: the EUVD affected-versions field states 'jupyter/jupyter unspecified ≤latest', which is broader than the description's pinpoint of 2.17.0 - defenders should treat 2.17.0 as confirmed vulnerable and verify other versions against vendor sources before assuming they are clean. |
| Exploit ScenarioDerived | An attacker with a low-privilege account on a multi-tenant JupyterHub deployment authenticates to their own single-user Jupyter Server (root_dir '/srv/notebooks/alice') and issues contents API requests whose paths resolve into a sibling like '/srv/notebooks-admin' or use '..' segments that survive to_os_path() normalization. Because _get_os_path() only checks startswith('/srv/notebooks') without a trailing separator, the request passes validation and the attacker reads or overwrites notebooks, tokens, or configuration belonging to another tenant. A proof-of-concept is referenced via the huntr report, making weaponization for a knowledgeable attacker straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 03, 2026
Path traversal in Jupyter Server 2.17.0 allows authenticated users to read and write files in sibling directories outside the configured root, via a flawed startswith() boundary check in _get_os_path() combined with to_os_path() failing to strip '..' sequences. With CVSS 8.1 (high confidentiality and integrity impact) and a publicly available proof-of-concept disclosed through huntr, the issue is particularly dangerous in shared/multi-tenant hosting where multiple Jupyter instances share a parent directory. EPSS is currently low (0.05%), and there is no public exploit identified at time of analysis beyond the huntr POC reference.
Earlier versions of this analysis (2)
Path traversal in Jupyter Server 2.17.0 allows authenticated remote users to read and write files in sibling directories outside their designated root, due to a flawed boundary check in _get_os_path() that uses startswith() without a trailing separator. The flaw is compounded by to_os_path() failing to strip '..' sequences, enabling traversal payloads to escape the intended workspace. No public exploit identified at time of analysis, EPSS is low at 0.05%, and SSVC classifies technical impact as total but not automatable.
Path traversal in jupyter-server 2.17.0 allows authenticated remote attackers to read and write files outside the configured root directory by exploiting two compounding validation flaws in the contents service. The vulnerability arises from a missing trailing separator in a boundary check combined with unstripped traversal sequences in path normalization, making it bypassed through crafted path inputs targeting sibling directories. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the confidentiality and integrity impact is high in multi-tenant or shared hosting deployments where sensitive data may reside in adjacent directories.
RemediationAI
No vendor-released patch identified at time of analysis from the provided data - monitor the huntr bounty page (https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f), the jupyter-server GitHub releases/security advisories, and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-5422) for a fixed version above 2.17.0 and upgrade as soon as it ships. As compensating controls until a patch lands, ensure each Jupyter Server instance's root_dir has no sibling directories sharing a name prefix (e.g., rename '/srv/notebooks-admin' so it cannot match '/srv/notebooks' via startswith), or place each user's root_dir inside its own dedicated parent with no siblings - the trade-off is operational/storage layout changes. Additionally, restrict accounts that can authenticate to the contents API on shared hosts (since PR:L is required), run each tenant under a separate OS user with filesystem ACLs that deny cross-tenant reads/writes regardless of application-layer checks, and front the server with an authenticating reverse proxy to limit who can reach the API; the side effect is added auth/proxy operational overhead but it materially reduces blast radius.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jupyter Server is the backend that powers JupyterLab, Jupyter Notebook, and Voila, exposing an HTTP/WebSocket API to manage notebook files and kernels. The vulnerability is a CWE-23 (Relative Path Traversal) caused by two interacting bugs in the contents service: jupyter_server/services/contents/fileio.py uses path.startswith(root) without appending os.sep, so a configured root_dir like '/srv/notebooks' matches sibling directories such as '/srv/notebooks-admin', and jupyter_server/utils.py's to_os_path() does not normalize or strip '..' segments, so URL-supplied path components are joined verbatim before the flawed boundary check. The result is that the sandbox intended to constrain file operations to root_dir can be escaped through prefix-collision sibling directories combined with relative traversal.
Know when Jupyter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.
Executive ViewAI
Jupyter Server 2.17.0 contains a path traversal vulnerability enabling unauthorized access to files outside the configured scope, with publicly available exploit code disclosed. Organizations operating Jupyter in shared or multi-tenant environments face significant risk of inter-tenant data exposure and unauthorized file modification. Immediate containment is required pending vendor patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Jupyter Server access to authenticated users with legitimate business need; (2) Implement strict file system permissions confining the Jupyter process to its configured root directory only; (3) Deploy instances in isolated containers with read-only parent directory mounts; (4) Enable real-time file access monitoring and alerting on unexpected traversal attempts; (5) Network segmentation to prevent inter-instance communication in multi-tenant deployments; (6) Disable or suspend non-critical Jupyter instances until patched versions are available; (7) Monitor Jupyter project release schedule and security advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
JupyterLab extension template is a `copier` template for JupyterLab extensions. Rated critical severity (CVSS 9.8), this
The Jupyter notebook is a web-based notebook environment for interactive computing. Rated critical severity (CVSS 9.6),
JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. Rated cri
Path traversal in Jupyter nbviewer through version 1.0.1 allows unauthenticated remote attackers to read files from sibl
The Jupyter Server provides the backend (i.e. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitab
In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. Rated medium severity (CVSS 6.1), this
Unauthenticated remote command execution is possible in MLJAR Mercury 3.0.0 through 3.2.3 because a missing comma in the
`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). Rated critical se
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provi
jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion +
Visual Studio Code Jupyter Extension Spoofing Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments
Exploit-DB