EUVD-2026-33905
GHSA-gf7q-q4j7-hp7c
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionNVD
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.
AnalysisAI
Path traversal in Jupyter Server 2.17.0 allows authenticated users to read and write files in sibling directories outside the configured root, via a flawed startswith() boundary check in _get_os_path() combined with to_os_path() failing to strip '..' sequences. With CVSS 8.1 (high confidentiality and integrity impact) and a publicly available proof-of-concept disclosed through huntr, the issue is particularly dangerous in shared/multi-tenant hosting where multiple Jupyter instances share a parent directory. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Jupyter Server 2.17.0 instances, particularly in multi-tenant configurations; restrict network access to trusted sources only; review recent access logs for suspicious directory traversal patterns. Within 7 days: Implement file system restrictions (strict directory ACLs limiting process to configured root only); enable comprehensive file access auditing; isolate affected instances from other critical systems. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission
Heap out-of-bounds read in Sereal::Decoder for Perl before version 5.005 allows remote attackers to leak up to 31 bytes
Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacke
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today