CVE-2026-111093 in Datalore
Summary
by MITRE • 10/15/2026
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in JetBrains Datalore prior to version 2026.2.1 represents a critical security flaw rooted in improper input validation and insufficient access control mechanisms within the application's reporting subsystem. Specifically, this issue manifests as an unauthenticated path traversal attack vector located at the report blob endpoint. This type of vulnerability allows attackers who do not possess valid credentials to manipulate file system paths by injecting special characters or sequences that break out of the intended directory structure. By exploiting weaknesses in how the server processes user-supplied input for file retrieval operations, malicious actors can bypass security restrictions designed to isolate application data from sensitive system files.
From a technical perspective, the flaw lies in the handling of relative path components such as dot-dot-slash sequences or encoded variations thereof within HTTP requests directed at the report blob endpoint. When the server receives these malformed paths without adequate sanitization or canonicalization checks, it resolves them against the underlying file system rather than restricting access to only authorized resource directories. This lack of strict boundary enforcement enables the reading of arbitrary files stored on the host machine where Datalore is deployed. The absence of authentication requirements for this specific endpoint exacerbates the severity, as any external actor with network connectivity can attempt exploitation without needing to bypass login mechanisms or steal session tokens first.
The operational impact of this vulnerability is significant due to its potential for data exfiltration and further system compromise. An attacker could read sensitive configuration files containing database credentials, API keys, or internal service endpoints that are not meant to be publicly accessible. In cloud-native environments where Datalore might run with elevated privileges or access to shared storage volumes, the consequences extend beyond simple file reading. Access to these confidential artifacts can facilitate lateral movement within a network, allow for credential stuffing attacks against other services using extracted secrets, or provide intelligence necessary for crafting more sophisticated targeted attacks against the organization's infrastructure.
This vulnerability aligns closely with Common Weakness Enumeration category CWE-22 Improper Limitation of a Pathname to a Restricted Directory and is often associated with ATT&CK technique T1083 File and Directory Discovery when used in reconnaissance phases, or T1560 Archive Collected Data if the attacker attempts to package stolen files for exfiltration. The unauthenticated nature also reflects CWE-287 Improper Authentication, indicating a failure to enforce identity verification before granting access to sensitive resources. These classifications highlight fundamental gaps in both input validation logic and security architecture design that must be addressed through rigorous code review and automated testing protocols during development lifecycles.
Mitigation strategies primarily involve upgrading JetBrains Datalore to version 2026.2.1 or later, where the vendor has implemented fixes for this path traversal issue. Until an upgrade is feasible, administrators should consider network-level controls such as web application firewalls configured to detect and block common path traversal patterns in HTTP requests targeting internal endpoints. Additionally, implementing strict file system permissions on the server hosting Datalore can limit the damage if exploitation occurs by ensuring that even successful reads are restricted to non-sensitive directories. Regular security audits focusing on input validation across all API endpoints remain essential for maintaining robust defense-in-depth posture against similar vulnerabilities in future releases or related JetBrains products.