Path Traversal Vulnerability in Jupyter Server Allows Unauthorized Directory Access

CVE-2026-35397

What is CVE-2026-35397?

In Jupyter Server versions 2.17.0 and earlier, a path traversal vulnerability exists within the REST API that allows authenticated users to bypass the configured root directory. This can lead to unauthorized access to sibling directories that share a common prefix with the root directory. For example, a directory named 'test' could potentially expose access to 'testtest' and others. This weakness poses a risk especially for multi-tenant environments with predictable naming conventions, allowing users to access unintended directories and manipulate files. The vulnerability could be mitigated by transitioning to version 2.18.0, which addresses this issue, or by avoiding folder names that share prefixes with sibling directories.

References