cross-site inclusion (XSSI) of files in jupyter-server
Medium4.6CVE-2023-40170 · Published Aug 29, 2023 · updated Sep 10, 2026
### Impact Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". ### Patches Jupyter Server 2.7.2 ### Workarounds Use lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks. ### References Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open. Vulnerability reported by Tim Coen via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyter-server PyPI | < 2.7.2 | 2.7.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-284, CWE-306, CWE-79
- Also known as
- CVE-2023-40170, PYSEC-2023-157
- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-64x5-55rw-9974
- nvd.nist.gov/vuln/detail/CVE-2023-40170
- github.com/jupyter-server/jupyter_server/commit/87a4927272819f0b1cae1afa4c8c86ee2da002fd
- github.com/jupyter-server/jupyter_server
- github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2023-157.yaml
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRP7DNZYVOIA4ZB3U3ZWKTFZEPYWNGCQ
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XDKQAWQN6SQTOVACZNXYKEHWQXGG4DOF
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 62024 | Jupyter server on Windows discloses Windows user password hash High7.5Jun 6, 2024 | High7.5 | 2.14.1 |
| Mar 282024 | Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie TossingHigh8.1Mar 28, 2024 | High8.1 | 4.1.0 |
| Jan 192024 | JupyterLab vulnerable to potential authentication and CSRF tokens leakHigh7.6Jan 19, 2024 | High7.6 | 3.6.7+2 more |
| Jan 192024 | JupyterLab vulnerable to SXSS in Markdown PreviewMedium6.5Jan 19, 2024 | Medium6.5 | 4.0.11+1 more |
| Dec 52023 | jupyter-server errors include tracebacks with path informationMedium4.3Dec 5, 2023 | Medium4.3 | 2.11.2 |
| Aug 292023 | Open Redirect Vulnerability in jupyter-serverMedium6.1Aug 29, 2023 | Medium6.1 | 2.7.2 |