CVE-2023-40170
cross-site inclusion (XSSI) of files in jupyter-server
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
cross-site inclusion (XSSI) of files in jupyter-server
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
- Record
CVE-2023-40170- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-284, CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2023-0103
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
- Record
EUVD-2023-0103- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-64x5-55rw-9974
cross-site inclusion (XSSI) of files in jupyter-server
Impact
Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab".
Patches
Jupyter Server 2.7.2
Workarounds
Use lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
References
Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open.
Vulnerability reported by Tim Coen via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
- Record
GHSA-64x5-55rw-9974- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79, CWE-284, CWE-306
- Updated
- 2026-11-02
NVD
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
- Record
CVE-2023-40170- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-284, CWE-306, CWE-79
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-40170
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
- Record
ALPINE-CVE-2023-40170- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
OSV
cross-site inclusion (XSSI) of files in jupyter-server
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
- Record
CVE-2023-40170- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-284, CWE-306
- Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2023-40170
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
- Record
DEBIAN-CVE-2023-40170- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-64x5-55rw-9974
cross-site inclusion (XSSI) of files in jupyter-server
Impact
Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab".
Patches
Jupyter Server 2.7.2
Workarounds
Use lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
References
Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open.
Vulnerability reported by Tim Coen via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
- Record
GHSA-64x5-55rw-9974- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-284, CWE-306, CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2023-157
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
- Record
PYSEC-2023-157- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-40170
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
- Record
UBUNTU-CVE-2023-40170- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13260-1 No score
python310-jupyter-server-2.7.3-1.1 on GA media
These are all security issues fixed in the python310-jupyter-server-2.7.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13260-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12012-1 No score
python313-jupyter-server-2.20.0-1.3 on GA media
These are all security issues fixed in the python313-jupyter-server-2.20.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12012-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jupyter-serverPyPI |
before 2.7.2 | 2.7.2 |
jupyter-serverAlpine:v3.19 |
before 2.7.3-r0 | 2.7.3-r0 |
jupyter-serverAlpine:v3.20 |
before 2.7.3-r0 | 2.7.3-r0 |
jupyter-serverAlpine:v3.21 |
before 2.7.3-r0 | 2.7.3-r0 |
jupyter-serverAlpine:v3.22 |
before 2.7.3-r0 | 2.7.3-r0 |
jupyter-serverAlpine:v3.23 |
before 2.7.3-r0 | 2.7.3-r0 |
jupyter-serverAlpine:v3.24 |
before 2.7.3-r0 | 2.7.3-r0 |
jupyter-serverDebian:12 |
All versions, plus listed versions 1.23.3-11.23.3-22.14.0-12.14.2-12.14.2-2 Show 9 moreShow less2.14.2-32.14.2-42.14.2-52.15.0-12.17.0-12.20.0-12.20.0-22.20.0-32.9.1-1 |
None known |
jupyter-serverDebian:13 |
before 2.14.2-1 | 2.14.2-1 |
jupyter-serverDebian:14 |
before 2.14.2-1 | 2.14.2-1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jupyter-serverPyPI |
before 2.7.2, plus listed versions 0.0.00.0.10.0.20.0.30.0.4 Show 45 moreShow less0.0.50.1.00.1.10.2.00.2.10.3.01.0.01.0.0rc01.0.0rc11.0.0rc101.0.0rc111.0.0rc121.0.0rc131.0.0rc141.0.0rc151.0.0rc161.0.0rc21.0.0rc31.0.0rc41.0.0rc51.0.0rc61.0.0rc71.0.0rc81.0.0rc91.0.11.0.101.0.111.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.10.01.10.11.10.21.11.01.11.1 |
2.7.2 |
jupyter-serverUbuntu:22.04:LTS |
All versions, plus listed versions 1.2.2-11.13.1-1 |
None known |
jupyter-serverUbuntu:24.04:LTS |
All versions, plus listed versions 1.23.3-11.23.3-2 |
None known |
jupyter-serverUbuntu:25.10 |
All versions, plus listed versions 2.14.2-52.15.0-1 |
None known |
jupyter-serverUbuntu:26.10 |
All versions, plus listed versions 2.17.0-12.20.0-3 |
None known |
jupyter-serverUbuntu:26.04:LTS |
All versions, plus listed versions 2.15.0-12.17.0-1 |
None known |
python-jupyter-serveropenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.20.0-1.3 | 2.20.0-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-40170 is a medium vulnerability (CVSS 4.6) in Jupyter Server, published August 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 50th percentile. Fixed in jupyter-server 2.7.2.
References
github.com/jupyter-server/jupyter_server/security/advisories/GHSA-64x5-55rw-9974
lists.fedoraproject.org/archives/list/[email protected]/message/XDKQAWQN6SQTOVACZNXYKEHWQXGG4DOF
nvd.nist.gov/vuln/detail/CVE-2023-40170
Show 11 moreShow less
security.alpinelinux.org/vuln/CVE-2023-40170
security-tracker.debian.org/tracker/CVE-2023-40170
ubuntu.com/security/CVE-2023-40170
cve.org/CVERecord?id=CVE-2023-40170
suse.com/security/cve/CVE-2023-39968
Left out here: 82 versions. The JSON record has them.