CVE-2026-5422: Jupyter Server Path Traversal – Privilege Escalation in Multi-Tenant Environments

Technical summary

CVE-2026-5422 is a path traversal vulnerability in jupyter-server 2.17.0 affecting the _get_os_path() function in jupyter_server/services/contents/fileio.py. The root cause involves two distinct flaws: (1) the root directory boundary check uses startswith(root) without enforcing a trailing path separator, permitting sibling directories whose names begin with the same prefix as root_dir to evade the check, and (2) the to_os_path() function in utils.py fails to normalize or strip ".." sequences from path components, enabling traversal payloads to bypass the weakened boundary validation. This combination allows authenticated users to construct paths that traverse outside the intended root directory.

Business impact

In multi-tenant or shared hosting environments, this vulnerability enables privilege escalation within a single server instance. An authenticated Jupyter user can read sensitive notebooks, configuration files, or data belonging to other users on the same server, or modify them maliciously. For organizations relying on Jupyter for collaborative data science or education, this represents a material confidentiality and integrity risk, particularly if the server hosts proprietary models, research data, or user-specific credentials. Incident response may require audit of file access logs and assessment of what data exposure occurred.

Affected systems

Jupyter Server version 2.17.0 is confirmed affected. Organizations running this specific version in multi-user or shared hosting scenarios are at direct risk. Verify whether your deployment uses this version via 'jupyter --version' or inspection of installed packages. Environments where Jupyter is containerized, isolated per user, or running in single-user mode have reduced but non-zero risk depending on threat model.

Exploitability

Exploitation requires valid Jupyter credentials (PR:L in CVSS) and network access to the Jupyter Server (AV:N). No user interaction is needed (UI:N), and exploitation is straightforward given knowledge of target directory names. The attack is not complex (AC:L). An authenticated attacker can craft a malicious API request or upload a notebook that exploits the path traversal during file operations. No public exploit is known to be in active use, but the flaw is logically obvious to security researchers and likely to be weaponized once widely known.

Remediation

Upgrade Jupyter Server to a patched version that corrects both the startswith() boundary check (adding path separator enforcement) and the path normalization in to_os_path(). Verify the specific patched version against the official Jupyter security advisory. As an interim measure, restrict Jupyter Server to single-user deployments, disable file upload/creation APIs if not required, or segregate users into separate server instances. Monitor file access logs for suspicious path traversal patterns (".." sequences in API requests).

Patch guidance

Check the official Jupyter project security advisory and release notes for the specific version that patches CVE-2026-5422. Apply the recommended update via 'pip install --upgrade jupyter-server=X.Y.Z' (substituting the patched version number). Verify the patch is installed with 'jupyter --version' and restart all running Jupyter Server instances. Test in a staging environment first to ensure no dependency conflicts or behavioral regressions. Coordinate patching across all affected servers in your environment.

Detection guidance

Search Jupyter Server logs and access logs for API requests containing ".." path traversal sequences, particularly in file read/write endpoints (e.g., /api/contents/). Monitor for unauthorized file access or modification events outside a user's designated directory. Endpoint detection and response (EDR) tools should flag child processes spawned by Jupyter with unusual file I/O patterns. Network-based detection is challenging without deep packet inspection; log analysis at the application layer is more effective. Check for suspicious patterns in Jupyter's request logs and cross-correlate with file system audit logs if available.

Why prioritize this

This vulnerability scores 8.1 (HIGH) due to high confidentiality and integrity impact (C:H, I:H) combined with low attack complexity and low privilege requirements. Although it requires authentication, in shared or multi-tenant Jupyter deployments, the presence of regular users—students, interns, or external collaborators—means the barrier to exploitation is practical and not merely theoretical. The impact on data confidentiality and file integrity justifies rapid patching. Organizations should prioritize this for their next maintenance window.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (1) Network-accessible attack vector (AV:N) with no special network conditions required, (2) Low attack complexity (AC:L) since path traversal exploitation is straightforward, (3) Low privilege requirement (PR:L) because only user-level Jupyter authentication is needed, (4) No user interaction (UI:N), (5) High confidentiality impact (C:H) from unauthorized file read access, (6) High integrity impact (I:H) from unauthorized file write/modification, and (7) No availability impact (A:N). The HIGH severity is appropriate for environments where Jupyter is shared among untrusted or semi-trusted users.

Frequently asked questions