CVE-2026-5422 is a path traversal vulnerability in jupyter-server 2.17.0 due to improper validation in the _get_os_path() and to_os_path() functions. The _get_os_path() function uses a startswith check without enforcing a trailing path separator, allowing directories with similar prefixes to bypass root boundary checks. Additionally, the to_os_path() function does not remove '..' path parts, enabling traversal sequences that circumvent protections. This can lead to unauthorized read and write access to files outside the intended root directory, risking exposure of sensitive data especially in shared hosting environments.

Successful exploitation of this vulnerability allows an attacker with limited privileges to read or write files in sibling directories outside the intended root directory. This can lead to unauthorized disclosure or modification of sensitive data on the server, increasing the risk in multi-tenant or shared hosting setups.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and consider isolating the jupyter-server environment to limit potential impact.