Answer in brief
CVE-2026-5422 records a Medium severity path traversal vulnerability in Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path(). The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Answer in brief
CVE-2026-5422 records a Medium severity path traversal vulnerability in Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path(). The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Update jupyter-server to 2.18.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-5422 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| jupyter-serverpip | <2.18.2 | 2.18.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-5422 records a Medium severity path traversal vulnerability in Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path(). The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for jupyter-server.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate jupyter-server to 2.18.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-5422 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| jupyter-serverpip | <2.18.2 | 2.18.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-5422 records a Medium severity path traversal vulnerability in Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path(). The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for jupyter-server.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5789-5fc7-67v3. This link is maintained to preserve external references. ### Original Description A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.
### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5789-5fc7-67v3. This link is maintained to preserve external references. ### Original Description A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.