PT-2026-59190 · Pypi · Jupyter Server

Published 2026-07-13 · Updated 2026-07-13

OSV

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the get os path() function within jupyter server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root dir to bypass the check. Additionally, the to os path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Fix

Related Identifiers

PYSEC-2026-2532

Affected Products

Jupyter Server

References · 7

• https://osv.dev/vulnerability/PYSEC-2026-2532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5422 · Security Note
• https://github.com/jupyter-server/jupyter_server · Note
• https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f · Note
• https://pypi.org/project/jupyter-server · Note
• http://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2 · Note
• https://github.com/advisories/GHSA-gf7q-q4j7-hp7c · Note