CVE-2026-35397 in jupyter_server
Summary
by MITRE • 05/05/2026
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories.
Version 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/29/2026
This vulnerability represents a critical path traversal flaw in Jupyter Server's REST API that enables authenticated users to escape designated directory boundaries through carefully crafted requests. The issue stems from inadequate input validation and path resolution logic within the /api/contents endpoint, which fails to properly sanitize or normalize path components. When a user specifies a root directory with a predictable name such as "test", the system's path handling mechanism allows traversal to sibling directories that begin with the same prefix, creating an exploitable condition where legitimate access controls are bypassed. The vulnerability specifically affects versions 2.17.0 and earlier, where the underlying implementation does not sufficiently validate path components to prevent directory traversal attacks.
The technical exploitation occurs through encoded path components that manipulate the API's internal path resolution mechanism. An attacker can construct requests that appear legitimate to the system's validation layer but actually cause the server to resolve paths incorrectly, allowing access to directories that should remain isolated. This vulnerability is particularly dangerous in multi-tenant environments where predictable naming conventions are common, as it enables lateral movement between user directories that share common prefixes. The impact extends beyond simple information disclosure to include full read, write, and delete capabilities within compromised sibling directories, effectively providing attackers with complete control over adjacent file systems.
The operational impact of this vulnerability is severe for organizations deploying Jupyter Server in shared or multi-tenant configurations. When users can select directory names that share prefixes with other legitimate directories, the attack surface expands dramatically. A user with a directory named "user1" could potentially access directories for user10 through user19 and beyond, creating cascading security breaches across multiple user accounts. This vulnerability aligns with CWE-22 Path Traversal and represents a specific implementation weakness in the server's directory access control mechanisms. From an attack perspective, this vulnerability maps to ATT&CK technique T1078 Valid Accounts and T1566 Phishing, as it leverages legitimate authentication to expand access privileges.
Organizations should immediately upgrade to version 2.18.0 or later, which implements proper path validation and normalization to prevent the traversal condition. The recommended workaround involves implementing strict naming conventions that prevent directory names from sharing common prefixes with sibling directories, though this approach requires careful planning and coordination. Security teams should also implement monitoring for unusual API access patterns and consider additional authentication controls or network segmentation to limit the potential impact of such vulnerabilities. The fix addresses the root cause by ensuring that path components are properly validated and that directory traversal attempts are rejected before they can cause damage.