Every CVE Search/ Get API key

CVE-2026-5422

Path Traversal in jupyter/jupyter

6.8 MediumFix available

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

4.86%Up 4.8 points since Jun 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.8

Path Traversal in jupyter/jupyter

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Record
CVE-2026-5422
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
EUVDEUVD-2026-33905 6.8

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Record
EUVD-2026-33905
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-gf7q-q4j7-hp7c 6.8

Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5789-5fc7-67v3. This link is maintained to preserve external references.

Original Description

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Record
GHSA-gf7q-q4j7-hp7c
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
NVD 8.1

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Record
CVE-2026-5422
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
OSV 6.8

Path Traversal in jupyter/jupyter

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Record
CVE-2026-5422
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
OSVDEBIAN-CVE-2026-5422 8.1

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Record
DEBIAN-CVE-2026-5422
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-gf7q-q4j7-hp7c 6.8

Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5789-5fc7-67v3. This link is maintained to preserve external references.

Original Description

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Record
GHSA-gf7q-q4j7-hp7c
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
OSVPYSEC-2026-2532 6.8

Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Record
PYSEC-2026-2532
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-5422 8.1

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Record
UBUNTU-CVE-2026-5422
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:10972-1 No score

python311-jupyter-server-2.19.0-1.1 on GA media

These are all security issues fixed in the python311-jupyter-server-2.19.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10972-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jupyter-server
Debian:12
 All versions, plus listed versions
1.23.3-11.23.3-22.14.0-12.14.2-12.14.2-2
Show 9 moreShow less
2.14.2-32.14.2-42.14.2-52.15.0-12.17.0-12.20.0-12.20.0-22.20.0-32.9.1-1
 None known
jupyter-server
Debian:13
 All versions, plus listed versions
2.15.0-12.17.0-12.20.0-12.20.0-22.20.0-3
 None known
jupyter-server
Debian:14
 All versions, plus listed versions
2.15.0-12.17.0-12.20.0-12.20.0-22.20.0-3
 None known
jupyter-server
PyPI
 before 2.18.2, plus listed versions
0.0.00.0.10.0.20.0.30.0.4
Show 45 moreShow less
0.0.50.1.00.1.10.2.00.2.10.3.01.0.01.0.0rc01.0.0rc11.0.0rc101.0.0rc111.0.0rc121.0.0rc131.0.0rc141.0.0rc151.0.0rc161.0.0rc21.0.0rc31.0.0rc41.0.0rc51.0.0rc61.0.0rc71.0.0rc81.0.0rc91.0.11.0.101.0.111.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.10.01.10.11.10.21.11.01.11.1
2.18.2
jupyter-server
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.2-11.13.1-1
 None known
jupyter-server
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.23.3-11.23.3-2
 None known
jupyter-server
Ubuntu:25.10
 All versions, plus listed versions
2.14.2-52.15.0-1
 None known
jupyter-server
Ubuntu:26.10
 All versions, plus listed versions
2.17.0-12.20.0-3
 None known
jupyter-server
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.15.0-12.17.0-1
 None known
python-jupyter-server
openSUSE:Tumbleweed
 before 2.19.0-1.1
2.19.0-1.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5422 is a medium vulnerability (CVSS 6.8) in Jupyter Jupyter/jupyter, published June 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.86%, the 92nd percentile. Fixed in jupyter-server 2.18.2.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 107 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open