Vulnerability-Lookup

CVE-2026-5422 (GCVE-0-2026-5422)

Vulnerability from cvelistv5 – Published: 2026-06-02 09:11 – Updated: 2026-06-02 12:14

Title

Path Traversal in jupyter/jupyter

Summary

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Severity

6.8 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-02 12:13 UTC

CWE

CWE-23 - Relative Path Traversal

Assigner

@huntr_ai mitre root

References

1 reference

URL	Tags
https://huntr.com/bounties/24a36953-6490-466f-8cb…

Impacted products

1 product

Vendor	Product	Version	CPE status
jupyter	jupyter/jupyter	Affected: unspecified , ≤ latest (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5422",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T12:13:38.058844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T12:14:02.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyter/jupyter",
          "vendor": "jupyter",
          "versions": [
            {
              "lessThanOrEqual": "latest",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip \"..\" from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T09:11:15.755Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntr_ai"
      },
      "references": [
        {
          "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
        }
      ],
      "source": {
        "advisory": "24a36953-6490-466f-8cb2-a90d1ca56e0f",
        "discovery": "EXTERNAL"
      },
      "title": "Path Traversal in jupyter/jupyter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntr_ai",
    "cveId": "CVE-2026-5422",
    "datePublished": "2026-06-02T09:11:15.755Z",
    "dateReserved": "2026-04-02T12:44:03.302Z",
    "dateUpdated": "2026-06-02T12:14:02.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-5422",
      "date": "2026-09-18",
      "epss": "0.00437",
      "percentile": "0.37438"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "jupyter/jupyter",
                "vendor": "jupyter",
                "versions": [
                  {
                    "lessThanOrEqual": "latest",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "security@huntr.dev"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:jupyter:jupyter_server:2.17.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "87F99030-5066-4CF8-B180-8325414018AF",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip \"..\" from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de salto de ruta existe en jupyter-server versi\u00f3n 2.17.0 debido a una comprobaci\u00f3n incorrecta del l\u00edmite del directorio ra\u00edz en la funci\u00f3n _get_os_path() dentro de jupyter_server/services/contents/fileio.py. La comprobaci\u00f3n utiliza startswith(root) sin a\u00f1adir un separador de ruta final, lo que permite que directorios hermanos con nombres que comienzan con el mismo prefijo que root_dir eludan la comprobaci\u00f3n. Adem\u00e1s, la funci\u00f3n to_os_path() en utils.py no elimina \u0027..\u0027 de las partes de la ruta, lo que permite que las secuencias de salto eludan la comprobaci\u00f3n vulnerable. Esta vulnerabilidad puede conducir a acceso de lectura/escritura no autorizado a archivos en directorios hermanos, exponiendo potencialmente datos sensibles en entornos de alojamiento compartido."
          }
        ],
        "id": "CVE-2026-5422",
        "lastModified": "2026-07-22T19:10:00.120",
        "metrics": {
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.0"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.2,
              "source": "security@huntr.dev",
              "type": "Secondary"
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-5422",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T12:13:38.058844Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-02T10:16:25.800",
        "references": [
          {
            "source": "security@huntr.dev",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
          }
        ],
        "sourceIdentifier": "security@huntr.dev",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-23"
              }
            ],
            "source": "security@huntr.dev",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T15:20:51+00:00",
      "cve": "CVE-2026-5422",
      "id": "CVE-2026-5422",
      "initial_release_date": "2026-06-02T09:11:15.755000+00:00",
      "product_status:fixed": "27",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "323",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5422.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-06-04T02:30:59Z",
      "cve": "CVE-2026-5422",
      "id": "CVE-2026-5422",
      "initial_release_date": "2026-06-03T02:32:02Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-5422",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-5422.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-5422",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-02T12:13:38.058844Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-02T12:12:01.952Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "jupyter/jupyter",
              "vendor": "jupyter",
              "versions": [
                {
                  "lessThanOrEqual": "latest",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip \"..\" from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments."
            }
          ],
          "metrics": [
            {
              "cvssV3_0": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-23",
                  "description": "CWE-23 Relative Path Traversal",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-02T09:11:15.755Z",
            "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
            "shortName": "@huntr_ai"
          },
          "references": [
            {
              "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
            }
          ],
          "source": {
            "advisory": "24a36953-6490-466f-8cb2-a90d1ca56e0f",
            "discovery": "EXTERNAL"
          },
          "title": "Path Traversal in jupyter/jupyter"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "assignerShortName": "@huntr_ai",
        "cveId": "CVE-2026-5422",
        "datePublished": "2026-06-02T09:11:15.755Z",
        "dateReserved": "2026-04-02T12:44:03.302Z",
        "dateUpdated": "2026-06-02T12:14:02.747Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BREW-JUPYTERLAB-CVE-2026-5422 (PYSEC-2026-2532)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-09-17 19:02 – Source website

Summary

Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

Details

Severity

6.8 (Medium)


                    
                      CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

URL

Type

	https://nvd.nist.gov/vuln/detail/CVE-2026-5422	ADVISORY
	https://github.com/jupyter-server/jupyter_server	PACKAGE
	https://huntr.com/bounties/24a36953-6490-466f-8cb…	WEB
	http://github.com/jupyter-server/jupyter_server/c…	WEB
	https://pypi.org/project/jupyter-server	PACKAGE
	https://github.com/advisories/GHSA-gf7q-q4j7-hp7c	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "jupyter-server",
        "resource_purl": "pkg:pypi/jupyter-server@2.21.0",
        "upstream_fixed_in": "2.18.2"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "jupyterlab",
        "purl": "pkg:brew/jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "4.5.7_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/jupyter-server@2.21.0",
        "name": "jupyter-server",
        "resource": "jupyter-server",
        "strategy": "registry",
        "subject_version": "2.21.0"
      }
    ]
  },
  "details": "A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip \"..\" from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.",
  "id": "BREW-jupyterlab-CVE-2026-5422",
  "modified": "2026-09-17T19:02:18Z",
  "published": "2026-08-13T17:01:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5422"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyter-server/jupyter_server"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
    },
    {
      "type": "WEB",
      "url": "http://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/jupyter-server"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-gf7q-q4j7-hp7c"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path() ",
  "upstream": [
    "PYSEC-2026-2532",
    "CVE-2026-5422",
    "GHSA-gf7q-q4j7-hp7c"
  ]
}

FKIE_CVE-2026-5422

Vulnerability from fkie_nvd - Published: 2026-06-02 10:16 - Updated: 2026-07-22 19:10

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security@huntr.dev	https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f	Exploit, Third Party Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	jupyter	jupyter_server	2.17.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "jupyter/jupyter",
          "vendor": "jupyter",
          "versions": [
            {
              "lessThanOrEqual": "latest",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@huntr.dev"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jupyter:jupyter_server:2.17.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "87F99030-5066-4CF8-B180-8325414018AF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip \"..\" from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de salto de ruta existe en jupyter-server versi\u00f3n 2.17.0 debido a una comprobaci\u00f3n incorrecta del l\u00edmite del directorio ra\u00edz en la funci\u00f3n _get_os_path() dentro de jupyter_server/services/contents/fileio.py. La comprobaci\u00f3n utiliza startswith(root) sin a\u00f1adir un separador de ruta final, lo que permite que directorios hermanos con nombres que comienzan con el mismo prefijo que root_dir eludan la comprobaci\u00f3n. Adem\u00e1s, la funci\u00f3n to_os_path() en utils.py no elimina \u0027..\u0027 de las partes de la ruta, lo que permite que las secuencias de salto eludan la comprobaci\u00f3n vulnerable. Esta vulnerabilidad puede conducir a acceso de lectura/escritura no autorizado a archivos en directorios hermanos, exponiendo potencialmente datos sensibles en entornos de alojamiento compartido."
    }
  ],
  "id": "CVE-2026-5422",
  "lastModified": "2026-07-22T19:10:00.120",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-5422",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-02T12:13:38.058844Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-02T10:16:25.800",
  "references": [
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Secondary"
    }
  ]
}

GHSA-GF7Q-Q4J7-HP7C

Vulnerability from github – Published: 2026-06-02 12:31 – Updated: 2026-07-31 20:20

Withdrawn 2026-07-31

Summary

Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5789-5fc7-67v3. This link is maintained to preserve external references.

Original Description

Severity

6.8 (Medium)


                  
                    CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyter-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.18.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-5422"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T22:05:59Z",
    "nvd_published_at": "2026-06-02T10:16:25Z",
    "severity": "MODERATE"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-5789-5fc7-67v3. This link is maintained to preserve external references.\n\n### Original Description\nA path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip \"..\" from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.",
  "id": "GHSA-gf7q-q4j7-hp7c",
  "modified": "2026-07-31T20:20:51Z",
  "published": "2026-06-02T12:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5422"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-gf7q-q4j7-hp7c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyter-server/jupyter_server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-2532.yaml"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/jupyter-server"
    },
    {
      "type": "WEB",
      "url": "http://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path() ",
  "withdrawn": "2026-07-31T20:20:51Z"
}

OPENSUSE-SU-2026:10972-1

Vulnerability from csaf_opensuse - Published: 2026-06-08 00:00 - Updated: 2026-09-17 17:08

Summary

python311-jupyter-server-2.19.0-1.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2026-5422.

CVE-2026-5422

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Recommended: 24 products

Open the full advisory

PYSEC-2026-2532

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:04

Details

Severity

6.8 (Medium)


                  
                    CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Impacted products

Name	purl
jupyter-server	pkg:pypi/jupyter-server

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyter-server",
        "purl": "pkg:pypi/jupyter-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.18.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.0",
        "0.0.1",
        "0.0.2",
        "0.0.3",
        "0.0.4",
        "0.0.5",
        "0.1.0",
        "0.1.1",
        "0.2.0",
        "0.2.1",
        "0.3.0",
        "1.0.0",
        "1.0.0rc0",
        "1.0.0rc1",
        "1.0.0rc10",
        "1.0.0rc11",
        "1.0.0rc12",
        "1.0.0rc13",
        "1.0.0rc14",
        "1.0.0rc15",
        "1.0.0rc16",
        "1.0.0rc2",
        "1.0.0rc3",
        "1.0.0rc4",
        "1.0.0rc5",
        "1.0.0rc6",
        "1.0.0rc7",
        "1.0.0rc8",
        "1.0.0rc9",
        "1.0.1",
        "1.0.10",
        "1.0.11",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.7",
        "1.0.8",
        "1.0.9",
        "1.1.0",
        "1.1.1",
        "1.1.2",
        "1.1.3",
        "1.1.4",
        "1.10.0",
        "1.10.1",
        "1.10.2",
        "1.11.0",
        "1.11.1",
        "1.11.2",
        "1.12.0",
        "1.12.1",
        "1.13.0",
        "1.13.1",
        "1.13.2",
        "1.13.3",
        "1.13.4",
        "1.13.5",
        "1.15.0",
        "1.15.1",
        "1.15.2",
        "1.15.3",
        "1.15.4",
        "1.15.5",
        "1.15.6",
        "1.16.0",
        "1.17.0",
        "1.17.1",
        "1.18.0",
        "1.18.1",
        "1.19.0",
        "1.19.1",
        "1.2.0",
        "1.2.1",
        "1.2.2",
        "1.2.3",
        "1.21.0",
        "1.23.0",
        "1.23.1",
        "1.23.2",
        "1.23.3",
        "1.23.4",
        "1.23.5",
        "1.23.6",
        "1.24.0",
        "1.3.0",
        "1.4.0",
        "1.4.1",
        "1.5.0",
        "1.5.1",
        "1.6.0",
        "1.6.1",
        "1.6.2",
        "1.6.3",
        "1.6.4",
        "1.7.0",
        "1.7.0a1",
        "1.7.0a2",
        "1.8.0",
        "1.9.0",
        "2.0.0",
        "2.0.0a0",
        "2.0.0a1",
        "2.0.0a2",
        "2.0.0b0",
        "2.0.0b1",
        "2.0.0rc0",
        "2.0.0rc1",
        "2.0.0rc2",
        "2.0.0rc3",
        "2.0.0rc4",
        "2.0.0rc5",
        "2.0.0rc6",
        "2.0.0rc7",
        "2.0.0rc8",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.4",
        "2.0.5",
        "2.0.6",
        "2.0.7",
        "2.1.0",
        "2.10.0",
        "2.10.1",
        "2.11.0",
        "2.11.1",
        "2.11.2",
        "2.12.0",
        "2.12.1",
        "2.12.2",
        "2.12.3",
        "2.12.4",
        "2.12.5",
        "2.13.0",
        "2.14.0",
        "2.14.1",
        "2.14.2",
        "2.15.0",
        "2.16.0",
        "2.17.0",
        "2.18.0",
        "2.18.1",
        "2.2.0",
        "2.2.1",
        "2.3.0",
        "2.4.0",
        "2.5.0",
        "2.6.0",
        "2.7.0",
        "2.7.1",
        "2.7.2",
        "2.7.3",
        "2.8.0",
        "2.9.0",
        "2.9.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-5422",
    "GHSA-gf7q-q4j7-hp7c"
  ],
  "details": "A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip \"..\" from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.",
  "id": "PYSEC-2026-2532",
  "modified": "2026-07-13T16:04:22.645443Z",
  "published": "2026-07-13T15:46:13.935289Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5422"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyter-server/jupyter_server"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
    },
    {
      "type": "WEB",
      "url": "http://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/jupyter-server"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-gf7q-q4j7-hp7c"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path() "
}

RHSA-2026:43038

Vulnerability from csaf_redhat - Published: 2026-07-21 22:10 - Updated: 2026-09-18 23:55

Summary

Red Hat Security Advisory: Migration Toolkit for Applications

Severity

Critical

Scope

30 vulnerabilities in this advisory, including CVE-2026-5422.

CVE-2026-5422

A flaw was found in jupyter-server. This path traversal vulnerability exists due to insufficient validation of file paths, specifically an incorrect root directory boundary check and improper handling of directory traversal sequences. This allows a remote attacker with low privileges to bypass directory restrictions and gain unauthorized read and write access to files in sibling directories. This could lead to the exposure of sensitive data, particularly in shared hosting environments.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Fixed: 2 products Known not affected: 25 products

https://access.redhat.com/errata/RHSA-2026:43038

Open the full advisory

RHSA-2026:60520

Vulnerability from csaf_redhat - Published: 2026-08-27 14:50 - Updated: 2026-09-18 23:54

Summary

Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI

Severity

Critical

Scope

143 vulnerabilities in this advisory, including CVE-2026-5422.

CVE-2026-5422

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Fixed: 25 products Known not affected: 296 products

https://access.redhat.com/errata/RHSA-2026:60520

Open the full advisory

UBUNTU-CVE-2026-5422 (CVE-2026-5422)

Vulnerability from osv_ubuntu – Published: 2026-06-02 10:16 – Updated: 2026-06-11 13:01 – Source website

Details

Severity

6.8 (Medium)


                    
                      CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-5422	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-5422	REPORT
	https://huntr.com/bounties/24a36953-6490-466f-8cb…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyter-server",
            "binary_version": "1.13.1-1"
          },
          {
            "binary_name": "python3-jupyter-server",
            "binary_version": "1.13.1-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "jupyter-server",
        "purl": "pkg:deb/ubuntu/jupyter-server@1.13.1-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.2-1",
        "1.13.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyter-server",
            "binary_version": "1.23.3-2"
          },
          {
            "binary_name": "python3-jupyter-server",
            "binary_version": "1.23.3-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "jupyter-server",
        "purl": "pkg:deb/ubuntu/jupyter-server@1.23.3-2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.23.3-1",
        "1.23.3-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyter-server",
            "binary_version": "2.15.0-1"
          },
          {
            "binary_name": "python3-jupyter-server",
            "binary_version": "2.15.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "jupyter-server",
        "purl": "pkg:deb/ubuntu/jupyter-server@2.15.0-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.14.2-5",
        "2.15.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyter-server",
            "binary_version": "2.17.0-1"
          },
          {
            "binary_name": "python3-jupyter-server",
            "binary_version": "2.17.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "jupyter-server",
        "purl": "pkg:deb/ubuntu/jupyter-server@2.17.0-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.15.0-1",
        "2.17.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip \"..\" from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.",
  "id": "UBUNTU-CVE-2026-5422",
  "modified": "2026-06-11T13:01:58Z",
  "published": "2026-06-02T10:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-5422"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5422"
    },
    {
      "type": "REPORT",
      "url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-5422"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-5422 (GCVE-0-2026-5422)

BREW-JUPYTERLAB-CVE-2026-5422 (PYSEC-2026-2532)

FKIE_CVE-2026-5422

GHSA-GF7Q-Q4J7-HP7C

Duplicate Advisory

Original Description

OPENSUSE-SU-2026:10972-1

PYSEC-2026-2532

RHSA-2026:43038

RHSA-2026:60520

UBUNTU-CVE-2026-5422 (CVE-2026-5422)

Tags

Sightings

Nomenclature

Related by attack behaviour