CVE-2026-5422

Name of the Vulnerable Software and Affected Versions jupyter-server version 2.17.0

Description A path traversal issue exists due to an incorrect root directory boundary check in the get os path() function within jupyter server/services/contents/fileio.py. The check utilizes startswith(root) without appending a trailing path separator, which allows sibling directories that share the same prefix as root dir to bypass the security check. Furthermore, the to os path() function in utils.py fails to strip ".." from path parts, enabling traversal sequences to bypass the check. This can result in unauthorized read and write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.