Path Traversal Vulnerability in Jupyter Server by Project Jupyter

CVE-2026-5422

What is CVE-2026-5422?

A path traversal vulnerability exists in Jupyter Server version 2.17.0 due to improper checks in the root directory boundary within the _get_os_path() function. The function uses startswith(root) without a trailing path separator, allowing unauthorized access to sibling directories. Additionally, the to_os_path() function fails to sanitize path components by not removing '..', which can lead to unauthorized read/write access to files outside the intended directories. This could expose sensitive data, particularly in shared hosting environments where security misconfigurations may arise.

References