CVE-2026-5422: 
Python vulnerability analysis and mitigation

CVE-2026-5422 is a relative path traversal vulnerability (CWE-23) in jupyter-server version 2.17.0 that allows authenticated remote attackers to read and write files outside the intended root directory. The flaw was published on June 2, 2026, and affects only the specific version 2.17.0 of the jupyter_server package. It carries a CVSS v3.1 base score of 8.1 (High) per NVD, while the GitHub Advisory Database rates it 6.8 (Moderate) using a higher attack complexity estimate (GitHub Advisory, Feedly).

The vulnerability has two compounding root causes in the jupyter-server codebase. First, the _get_os_path() function in jupyter_server/services/contents/fileio.py performs a boundary check using startswith(root) without appending a trailing path separator, meaning a sibling directory whose name shares the same prefix as root_dir (e.g., /data/notebooks-extra when root is /data/notebooks) can bypass the check. Second, the to_os_path() function in utils.py does not strip .. from path components, allowing traversal sequences to further escape the intended directory. Together, these flaws (classified as CWE-23: Relative Path Traversal) enable an authenticated user to craft API requests that resolve to file paths in sibling directories (GitHub Advisory, Huntr Bounty).

Successful exploitation allows an authenticated attacker to perform unauthorized read and write operations on files residing in sibling directories outside the configured Jupyter root directory. This poses a significant risk in shared hosting environments where multiple users or services store sensitive data in adjacent directories, potentially exposing credentials, configuration files, or proprietary notebooks. The vulnerability has no availability impact but carries high confidentiality and integrity impacts, meaning data exfiltration and file tampering are both feasible outcomes (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target running jupyter-server 2.17.0, particularly in shared hosting environments where sibling directories with sensitive data may exist adjacent to the Jupyter root directory.
2. Authentication: Obtain valid credentials or a token for the Jupyter server (low-privilege user access is sufficient).
3. Identify sibling directory prefix: Determine the root_dir path of the Jupyter server (e.g., /home/user/notebooks) and identify sibling directories sharing the same prefix (e.g., /home/user/notebooks-admin).
4. Craft traversal request: Send an API request to the Jupyter contents API (e.g., GET /api/contents/) with a path that exploits the startswith(root) bypass — for example, using a path that resolves to a sibling directory name, or embedding .. sequences that to_os_path() fails to strip.
5. Read/write target files: Use the traversal to read sensitive files (e.g., configuration files, credentials) or write malicious content (e.g., overwrite scripts) in the sibling directory, achieving data exfiltration or persistence (GitHub Advisory, Huntr Bounty).

• Network: Unusual HTTP GET or PUT requests to the Jupyter contents API (/api/contents/) containing path components with .. sequences or paths that resolve outside the configured root directory.
• Logs: Jupyter server access logs showing requests with encoded traversal sequences (e.g., %2F..%2F, ../) or paths referencing sibling directory names; unexpected file access patterns in server logs.
• File System: Unexpected access or modification timestamps on files in directories adjacent to (but not within) the Jupyter root directory; new or altered files in sibling directories not attributable to legitimate users.
• Process: Jupyter server process accessing file paths outside the configured root_dir as observed via system call monitoring (e.g., auditd, strace).

Users should upgrade jupyter-server beyond version 2.17.0 to a patched release as soon as one is available; the GitHub Advisory (GHSA-gf7q-q4j7-hp7c) confirms a patch exists (GitHub Advisory). As an interim workaround in shared hosting environments, administrators should apply strict OS-level file permissions to ensure the Jupyter server process cannot access sibling directories, and avoid naming sibling directories with prefixes that match the Jupyter root_dir. Network-level access controls (e.g., restricting Jupyter server access to trusted users only) can further reduce exposure until patching is complete.

The vulnerability received standard automated coverage across vulnerability tracking platforms (NVD, VulnDB, CIRCL, ENISA EUVD) shortly after disclosure on June 2, 2026. A brief mention appeared on Mastodon via @thehackerwire and on Bluesky, indicating limited but present community awareness. No significant vendor statements, notable researcher commentary, or major media coverage has been identified beyond routine database entries (Feedly).