PT-2026-59190 · Pypi · Jupyter Server

Publicado 2026-07-13 · Atualizado 2026-07-13

OSV

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the get os path() function within jupyter server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root dir to bypass the check. Additionally, the to os path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Correção

Identificadores relacionados

PYSEC-2026-2532

Produtos afetados

Jupyter Server

Referências · 7

• https://github.com/jupyter-server/jupyter_server · Nota
• https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f · Nota
• https://pypi.org/project/jupyter-server · Nota
• http://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2 · Nota
• https://osv.dev/vulnerability/PYSEC-2026-2532 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-5422 · Nota de Segurança
• https://github.com/advisories/GHSA-gf7q-q4j7-hp7c · Nota