CVE-2026-5422
published 2026-06-02CVE-2026-5422: A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within…
PriorityP260high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
4.86%
92.1th percentile
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jupyter-server | >= 0 < 2.18.2 | 2.18.2 |
| jupyter | jupyter_jupyter | unspecified – latest | — |
| jupyter | jupyter_server | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv3.06.8MEDIUMCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()
ghsa·2026-06-02
CVE-2026-5422 [MEDIUM] CWE-23 Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()
Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environment
GHSA
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.p
ghsa_unreviewed·2026-06-02
CVE-2026-5422 [MEDIUM] CWE-23 A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.p
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.
Red Hat
jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability
vendor_redhat·2026-06-02·CVSS 8.1
CVE-2026-5422 [HIGH] CWE-22 jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability
jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability
A flaw was found in jupyter-server. This path traversal vulnerability exists due to insufficient validation of file paths, specifically an incorrect root directory boundary check and improper handling of directory traversal sequences. This allows a remote attacker with low privileges to bypass directory restrictions and gain unauthorized read and write access to files in sibling directories. This could lead to the exposure of sensitive data, particularly in shared hosting environments.
Package: mta/mta-solution-server-rhel9 (Migration Toolkit for Applications 8) - Fix deferred
Package: rhoai/odh-th06-cpu-torch210-py312-rhel9 (Red Hat OpenShift AI (RHOAI)) - Fix deferred
Package: rhoai/odh-th06-cpu-
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-5422 python-jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability [fedora-all]
bugzilla·2026-06-08·CVSS 8.1
CVE-2026-5422 [HIGH] CVE-2026-5422 python-jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability [fedora-all]
CVE-2026-5422 python-jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5422 python-jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability [epel-all]
bugzilla·2026-06-08·CVSS 8.1
CVE-2026-5422 [HIGH] CVE-2026-5422 python-jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability [epel-all]
CVE-2026-5422 python-jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5422 jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability
bugzilla·2026-06-02·CVSS 8.1
CVE-2026-5422 [HIGH] CVE-2026-5422 jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability
CVE-2026-5422 jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability
HASH(0x5592a4a492b0)
2026-06-02
Published