Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🚨 HIGH: CVE-2026-5422 (CVSS 8.1) - Path traversal in jupyter-server 2.17.0 allows unauthorized file access in shared environments. Attackers can read/write files outside root directory. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/ADkSAqadm7
Post summary
The post announces a path traversal vulnerability (CVE-2026-5422) in jupyter-server 2.17.0 with CVSS 8.1, urging users to apply the patch immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jupyter | jupyter_server | 2.17.0 | - | - |