{"id":"CVE-2025-30167","aliases":["EUVD-2025-16771","GHSA-33p9-3p43-82vq","PYSEC-2026-1477","ROOT-APP-PYPI-CVE-2025-30167","UBUNTU-CVE-2025-30167","openSUSE-SU-2025:15272-1"],"status":"published","title":"Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability","description":"Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00198,"percentile":0.09708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427"],"published":"2025-06-03T16:42:16Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"PyPI","package":"jupyter-core","fixed_in":["5.8.0","5.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-jupyter-core","fixed_in":["5.8.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1"}]}],"versions":["4.0.0","4.0.0.dev","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.1.0","4.1.1","4.10.0","4.11.0","4.11.1","4.11.2","4.12.0","4.2.0","4.2.1","4.3.0","4.4.0","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.7.0","4.7.0rc0","4.7.1","4.8.0","4.8.0b0","4.8.0rc0","4.8.0rc1","4.8.1","4.8.2","4.9.0","4.9.0rc0","4.9.1","4.9.1rc0","4.9.2","5.0.0","5.0.0rc0","5.0.0rc1","5.0.0rc2","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5","5.2.0","5.3.0","5.3.1","5.3.2","5.4.0","5.5.0","5.5.1","5.6.0","5.6.1","5.7.0","5.7.1","5.7.2","5.8.0"]},{"source":"osv","ecosystem":"PyPI","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1"}]}],"versions":["4.0.0","4.0.0.dev","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.1.0","4.1.1","4.10.0","4.11.0","4.11.1","4.11.2","4.12.0","4.2.0","4.2.1","4.3.0","4.4.0","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.7.0","4.7.0rc0","4.7.1","4.8.0","4.8.0b0","4.8.0rc0","4.8.0rc1","4.8.1","4.8.2","4.9.0","4.9.0rc0","4.9.1","4.9.1rc0","4.9.2","5.0.0","5.0.0rc0","5.0.0rc1","5.0.0rc2","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5","5.2.0","5.3.0","5.3.1","5.3.2","5.4.0","5.5.0","5.5.1","5.6.0","5.6.1","5.7.0","5.7.1","5.7.2","5.8.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.0-1","4.4.0-1","4.4.0-2","4.4.0-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.0-2","4.6.0-1","4.6.1-1","4.6.2-1ubuntu1","4.6.3-3","4.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.1-1","4.9.1-1","4.9.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.1-1","5.3.2-1","5.3.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.2-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.2-5","5.9.1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-jupyter-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-1.1"}]}]}],"products":[{"vendor":"jupyter","product":"jupyter_core"}],"references":[{"url":"https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30167","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-33p9-3p43-82vq","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30167.json","tags":["advisory"]},{"url":"https://github.com/jupyter/jupyter_core","tags":["package"]},{"url":"https://pypi.org/project/jupyter-core","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-30167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30167","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30167","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-30167","title":"Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability","description":"Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).","status":"published","published":"2025-06-03T16:42:16.357Z","modified":"2026-01-23T16:31:03.69Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-16771","description":"Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).","status":"published","published":"2025-06-03T16:42:16Z","modified":"2026-01-23T16:31:03Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:48.084617Z"}],"ghsa":[{"id":"GHSA-33p9-3p43-82vq","title":"Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability","description":"## Impact\n\nOn Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.\n\nOnly shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.\n\n## Mitigations\n\n- upgrade to `jupyter_core\u003e=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or\n- as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or\n- as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions, or\n- as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)\n\n## Credit\n\nReported via Trend Micro Zero Day Initiative as ZDI-CAN-25932","status":"published","published":"2025-06-04T21:00:23Z","modified":"2026-01-23T16:31:16Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:39:19.525691Z"}],"nvd":[{"id":"CVE-2025-30167","description":"Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).","status":"published","published":"2025-06-03T17:15:21.52Z","modified":"2026-06-17T09:08:17.083Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"CVE-2025-30167","title":"Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability","description":"Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).","status":"published","published":"2025-06-03T16:42:16.357Z","modified":"2026-10-28T02:30:50.638570829Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-33p9-3p43-82vq","title":"Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability","description":"## Impact\n\nOn Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.\n\nOnly shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.\n\n## Mitigations\n\n- upgrade to `jupyter_core\u003e=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or\n- as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or\n- as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions, or\n- as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)\n\n## Credit\n\nReported via Trend Micro Zero Day Initiative as ZDI-CAN-25932","status":"published","published":"2025-06-04T21:00:23Z","modified":"2026-09-10T03:50:24.75494627Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"PYSEC-2026-1477","title":"Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability","description":"## Impact\n\nOn Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.\n\nOnly shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.\n\n## Mitigations\n\n- upgrade to `jupyter_core\u003e=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or\n- as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or\n- as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions, or\n- as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)\n\n## Credit\n\nReported via Trend Micro Zero Day Initiative as ZDI-CAN-25932","status":"published","published":"2026-07-07T16:02:53.65451Z","modified":"2026-07-07T17:46:46.038225137Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2025-30167","description":"Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).","status":"published","published":"2025-06-03T17:15:00Z","modified":"2026-10-17T12:56:49.995185802Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"openSUSE-SU-2025:15272-1","title":"python311-jupyter-core-5.8.1-1.1 on GA media","description":"These are all security issues fixed in the python311-jupyter-core-5.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:35.173743Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"ROOT-APP-PYPI-CVE-2025-30167","title":"CVE-2025-30167 in rootio-jupyter_core - Patched by Root","description":"Root has patched CVE-2025-30167 in the rootio-jupyter_core package for Root:PyPI. Multiple fixed versions available.","status":"withdrawn","published":"2025-11-02T17:36:23Z","modified":"2026-09-06T14:00:07.06618613Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}