CVE-2026-5422 — HIGH (8.1) — White Hats Nepal

Vulnerability Description

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Jupyter	Jupyter Server	2.17.0

Related Weaknesses (CWE)

CWE-23

References

https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0fExploitThird Party Advisory
https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0fExploitThird Party Advisory

FAQ

What is CVE-2026-5422?

CVE-2026-5422 is a vulnerability with a CVSS score of 8.1 (HIGH). A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.p...

How severe is CVE-2026-5422?

CVE-2026-5422 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-5422?

Check the references section above for vendor advisories and patch information. Affected products include: Jupyter Jupyter Server.