Jupyter: path traversal
High7.1CVE-2026-35397 · Published May 5, 2026 · updated Sep 10, 2026
### Summary Jupyter Server <=2.17.0 can access directories sibling to the root directory, if it starts with the root dir's name. ### PoC Minimal: ``` . ├── test/ <- root directory. │ └── test.txt └── testtest/ └── secret.txt <- file to exfiltrate that we should not be able to access via API ``` ```bash HOST="http://localhost:8888" TOKEN="" SIBLING="testtest" TARGET="secret.txt" curl -s -X POST \ "$HOST/api/contents/%2e%2e/$SIBLING/$TARGET/checkpoints" \ -H "Authorization: token $TOKEN" ``` Full PoC by @stef41: https://gist.github.com/Yann-P/66d4982a965dee8fcb8dd89db29e7006 ### Impact It is possible for an authenticated user to access content outside the server's `root_dir` in siblings directories sharing the same prefix as the `root_dir`. The attacker can escalate access, reading, writing, and deleting from sibling directories. This can have a tangible impact for deployments using predictable naming scheme with multi-tenant server, for example `user1`, `user2`, `user3`, ..., `user10` etc, as `user1` could access and modify files of all `user10` - `user19` and higher. In a hypothetical system where users can choose a name of their folder, an att...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyter-server PyPI | < 2.18.0 | 2.18.0 |
Details and references
### Summary Jupyter Server <=2.17.0 can access directories sibling to the root directory, if it starts with the root dir's name. ### PoC Minimal: ``` . ├── test/ <- root directory. │ └── test.txt └── testtest/ └── secret.txt <- file to exfiltrate that we should not be able to access via API ``` ```bash HOST="http://localhost:8888" TOKEN="" SIBLING="testtest" TARGET="secret.txt" curl -s -X POST \ "$HOST/api/contents/%2e%2e/$SIBLING/$TARGET/checkpoints" \ -H "Authorization: token $TOKEN" ``` Full PoC by @stef41: https://gist.github.com/Yann-P/66d4982a965dee8fcb8dd89db29e7006 ### Impact It is possible for an authenticated user to access content outside the server's `root_dir` in siblings directories sharing the same prefix as the `root_dir`. The attacker can escalate access, reading, writing, and deleting from sibling directories. This can have a tangible impact for deployments using predictable naming scheme with multi-tenant server, for example `user1`, `user2`, `user3`, ..., `user10` etc, as `user1` could access and modify files of all `user10` - `user19` and higher. In a hypothetical system where users can choose a name of their folder, an attacker could choose a single-letter username to gain access to a significant number of sibling directories. ### Workarounds Use folder names that do not overlap. ### Acknowledgments Thank you to @stef41 for providing a useful PoC.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2026-35397, PYSEC-2026-68
- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3
- nvd.nist.gov/vuln/detail/CVE-2026-35397
- access.redhat.com/errata/RHSA-2026:43038
- access.redhat.com/errata/RHSA-2026:60520
- access.redhat.com/security/cve/CVE-2026-35397
- bugzilla.redhat.com/show_bug.cgi?id=2466858
- github.com/jupyter-server/jupyter_server
- github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-68.yaml
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35397.json
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 6 | JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content High9.6May 6 | High9.6 | 4.5.7+1 more |
| May 5 | Jupyter: improper input validationHigh8.8May 5 | High8.8 | 4.5.7 |
| May 5 | JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)Medium5.4May 5 | Medium5.4 | 5.4.5 |
| May 5 | Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server RestartHigh6.8May 5 | High6.8 | 2.18.0 |
| May 5 | Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`HighMay 5 | High | 2.18.0 |
| May 5 | Jupyter Server has an open redirection vulnerability in `next` query parameterMediumMay 5 | Medium | 2.18.0 |