CVE-2026-35397: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jupyter-server jupyter_server
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory.
AI Analysis
Technical Summary
CVE-2026-35397 is a CWE-22 path traversal vulnerability in jupyter_server versions before 2.18.0. The server improperly limits pathname access, allowing an authenticated user to access directories sibling to the configured root directory if the sibling directory's name starts with the root directory's name. This enables unauthorized access to files outside the root directory, including reading, writing, and deletion. The vulnerability is particularly impactful in multi-tenant deployments with predictable or overlapping folder naming schemes. A proof-of-concept demonstrates accessing files in sibling directories by exploiting this naming overlap. The vendor has released a patch in version 2.18.0 to fix this issue.
Potential Impact
Authenticated users can bypass directory restrictions and access, modify, or delete files in sibling directories of the server's root directory if those directories share a prefix with the root directory's name. This can lead to unauthorized data exposure and potential data tampering in multi-tenant environments where folder names overlap or follow predictable patterns.
Mitigation Recommendations
A patch is available in jupyter_server version 2.18.0 and later; upgrading to this version or newer will remediate the vulnerability. As a temporary workaround, avoid using folder names that overlap or share prefixes to prevent unauthorized access to sibling directories. Check the vendor advisory for the latest remediation guidance.
CVE-2026-35397: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jupyter-server jupyter_server
Description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory.
CVSS v4.0
Score 7.6high
Affected software
jupyter-server
jupyter_server
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-35397 is a CWE-22 path traversal vulnerability in jupyter_server versions before 2.18.0. The server improperly limits pathname access, allowing an authenticated user to access directories sibling to the configured root directory if the sibling directory's name starts with the root directory's name. This enables unauthorized access to files outside the root directory, including reading, writing, and deletion. The vulnerability is particularly impactful in multi-tenant deployments with predictable or overlapping folder naming schemes. A proof-of-concept demonstrates accessing files in sibling directories by exploiting this naming overlap. The vendor has released a patch in version 2.18.0 to fix this issue.
Potential Impact
Authenticated users can bypass directory restrictions and access, modify, or delete files in sibling directories of the server's root directory if those directories share a prefix with the root directory's name. This can lead to unauthorized data exposure and potential data tampering in multi-tenant environments where folder names overlap or follow predictable patterns.
Mitigation Recommendations
A patch is available in jupyter_server version 2.18.0 and later; upgrading to this version or newer will remediate the vulnerability. As a temporary workaround, avoid using folder names that overlap or share prefixes to prevent unauthorized access to sibling directories. Check the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-02T17:03:42.074Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-35397","vendor":"Red Hat"}]
Threat ID: 69fa4dc2cbff5d86102152b2
Added to database: 05/05/2026, 20:06:26 UTC
Last enriched: 08/01/2026, 21:31:11 UTC
Last updated: 09/17/2026, 10:01:31 UTC
Views: 137
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.