PT-2026-37232 · Project Jupyter · Jupyter Server

Stef41 · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-35397

Positive Technologies (AI Summary)

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 2.18.0

Description A path traversal issue in the REST API allows an authenticated user to escape the configured root dir and access sibling directories that share the same prefix as the root dir. By sending a crafted request to the '/api/contents' endpoint using encoded path components, an attacker can read, write, and delete files in these sibling directories. This is particularly critical in multi-tenant deployments using predictable naming schemes; for instance, a user with a directory named user1 could access directories named user10 through user19. Users capable of choosing single-character folder names could potentially access a larger number of sibling directories.

Recommendations Update to version 2.18.0. As a temporary workaround, ensure folder names do not share a common prefix with any sibling directory.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35397

GHSA-5789-5FC7-67V3

Affected Products

Jupyter Server

References · 6

• https://osv.dev/vulnerability/GHSA-5789-5fc7-67v3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35397 · Security Note
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3 · Note
• https://github.com/jupyter-server/jupyter_server · Note
• https://twitter.com/UpwindMDR/status/2051719825617997874 · Twitter Post
• https://twitter.com/CVEnew/status/2051758505523077506 · Twitter Post