CVE-2026-5422: Jupyter Server Path Traversal Vulnerability

CVE-2026-5422 Overview

CVE-2026-5422 is a path traversal vulnerability [CWE-23] affecting Jupyter Server version 2.17.0. The flaw resides in the _get_os_path() function within jupyter_server/services/contents/fileio.py, which performs a root directory boundary check using startswith(root) without appending a trailing path separator. An authenticated attacker can use sibling directory names sharing the same prefix as root_dir to bypass the check. The to_os_path() function in utils.py compounds the issue by failing to strip .. sequences from path components. Successful exploitation grants unauthorized read and write access to files in sibling directories, exposing sensitive data in shared hosting environments.

Critical Impact
Authenticated attackers can read and write arbitrary files outside the configured Jupyter root directory, compromising confidentiality and integrity in multi-tenant deployments.

Affected Products

Jupyter Server 2.17.0
Deployments using jupyter:jupyter_server 2.17.0
Shared and multi-tenant Jupyter hosting environments running the affected release

Discovery Timeline

2026-06-02 - CVE-2026-5422 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-5422

Vulnerability Analysis

The vulnerability stems from a string-prefix comparison used to enforce filesystem boundaries. The _get_os_path() function calls startswith(root) against the resolved request path. Without a trailing separator on root, directories named with the same textual prefix satisfy the check. For example, if root_dir is /srv/notebooks, a path resolving under /srv/notebooks_backup passes validation because the prefix string matches.

The to_os_path() helper in utils.py accepts API path segments and joins them with the root directory. It does not filter .. components, so traversal sequences supplied by an authenticated user propagate through the resolved path. The combination defeats the intended sandbox and lets a low-privileged user reference files outside the workspace.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-23]. Two defects interact: a prefix-only boundary check that does not enforce directory separator semantics, and a path-normalization routine that preserves parent-directory references. Either issue alone weakens isolation; together they enable reliable traversal.

Attack Vector

Exploitation requires network access to the Jupyter Server endpoint and valid low-privilege credentials. The attacker submits API requests containing crafted relative paths or filenames whose canonical resolution lands in a sibling directory. Because the boundary check accepts the prefix match, the server reads or writes the target file using the Jupyter process's filesystem privileges. No user interaction is required and the attack complexity is low.

No public proof-of-concept code is published. Technical details are described in the Huntr Bug Bounty Report.

Detection Methods for CVE-2026-5422

Indicators of Compromise

HTTP requests to Jupyter Server contents API endpoints containing .. sequences or URL-encoded equivalents such as %2e%2e%2f.
File access events from the Jupyter Server process targeting paths outside the configured root_dir.
Unexpected write or modification activity on files in directories that share a textual prefix with root_dir (for example notebooks_backup next to notebooks).

Detection Strategies

Audit Jupyter Server access logs for API calls to /api/contents/ referencing traversal patterns or unusually long relative paths.
Correlate the Jupyter process identifier with filesystem telemetry to flag opens outside the intended workspace directory.
Inspect authenticated session activity for users requesting resources that resolve to sibling directories of root_dir.

Monitoring Recommendations

Enable verbose request logging on the Jupyter Server and forward logs to a centralized analytics platform for retention and search.
Deploy file integrity monitoring on directories adjacent to any configured root_dir to surface unauthorized writes.
Alert on Jupyter Server processes invoking syscalls against paths outside an allowlist derived from the documented workspace root.

How to Mitigate CVE-2026-5422

Immediate Actions Required

Inventory Jupyter Server deployments and identify hosts running version 2.17.0.
Upgrade to a fixed release of jupyter_server once the maintainers publish a patched version; track the Huntr Bug Bounty Report for fix status.
Restrict network exposure of Jupyter Server instances to trusted networks and require strong authentication for all users.
Rotate credentials and review filesystem audit logs for evidence of unauthorized access following exposure.

Patch Information

At the time of NVD publication on 2026-06-02, no vendor advisory URL or fixed-version reference is listed in the CVE record. Administrators should consult the upstream jupyter_server project release notes and the linked Huntr report for remediation guidance and upgrade once a corrected release is available.

Workarounds

Place each Jupyter Server instance in an isolated filesystem location with no sibling directories whose names share a prefix with root_dir.
Run Jupyter Server under a dedicated unprivileged user account with filesystem permissions limited strictly to the workspace path.
Deploy Jupyter Server inside a container or chroot so that traversal beyond the workspace cannot reach sensitive host files.
Apply a reverse proxy rule that rejects API requests containing .. or encoded traversal sequences in path parameters.

bash

# Example nginx rule blocking traversal sequences in Jupyter API requests
location /api/contents/ {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://jupyter_backend;
}