CVE-2026-5422: Jupyter path traversal exposes sibling

Q: Is CVE-2026-5422 actively exploited?

No confirmed active exploitation of CVE-2026-5422 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-5422?

1) Upgrade jupyter-server to a version beyond 2.17.0 — monitor the project GitHub releases for the patched build (reference: huntr.com bounty 24a36953). 2) For shared deployments, isolate each user's Jupyter root to a dedicated containerized or VM-based environment — do not rely solely on directory-level path checks. 3) Audit the directory structure around your Jupyter root for sensitive files reachable via sibling-directory traversal. 4) Implement filesystem-level ACLs (AppArmor or SELinux profiles) restricting the Jupyter process strictly to its intended root tree. 5) Monitor server access logs for requests to /api/contents containing '../' or percent-encoded traversal sequences in file path parameters.

Q: What systems are affected by CVE-2026-5422?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data science workspaces, agent frameworks, model development environments, MLOps platforms.

Q: What is the CVSS score for CVE-2026-5422?

CVE-2026-5422 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.44%.

CISO Take

A path traversal flaw in jupyter-server 2.17.0 allows an authenticated user to read and write files outside the designated root directory by exploiting a missing trailing separator in the boundary check combined with unstripped '..' path components in the to_os_path() utility. In shared or multi-tenant Jupyter environments — common in AI/ML research clusters, data science platforms, and educational institutions — this means one user can access another's notebooks, training datasets, API keys, or model artifacts stored in adjacent directories. No CVSS score or EPSS data is published yet and no public exploit or KEV listing exists, but the attack primitive is classic path traversal requiring minimal skill from any authenticated user on a shared system. Upgrade jupyter-server beyond 2.17.0 immediately on any shared deployment; single-user containerized instances have significantly reduced exposure.

Sources: NVD ATLAS huntr.com

What is the risk?

Medium-High for multi-tenant or shared Jupyter deployments (JupyterHub, hosted data science platforms, research institution servers). Low for isolated single-user containerized instances. The root boundary bypass requires only basic path manipulation — no AI/ML expertise needed — making it accessible to any authenticated user on a shared system. Blast radius is bounded by what sibling directories contain, but in AI/ML environments these commonly hold sensitive assets: dataset files, model weights, environment configs with API keys, and SSH credentials.

How does the attack unfold?

Initial Access

Attacker obtains a standard authenticated user account on a shared Jupyter deployment such as JupyterHub, a hosted data science platform, or a multi-user research server.

AML.T0012

Exploitation

Attacker crafts an API request to jupyter-server's /api/contents endpoint with a path containing '../' sequences targeting a sibling directory whose name shares the root_dir prefix, bypassing the flawed startswith() boundary check in _get_os_path().

AML.T0049

Collection

Attacker reads or enumerates sensitive files from adjacent user workspaces or system directories — training datasets, model weights, API keys, SSH credentials, or proprietary notebooks stored outside the intended root.

AML.T0037

Impact

Stolen AI artifacts and credentials are exfiltrated, or attacker writes malicious notebook content to victim workspaces enabling follow-on training data poisoning, credential-based lateral movement, or code execution on the victim's next kernel start.

AML.T0025

Initial Access

Attacker obtains a standard authenticated user account on a shared Jupyter deployment such as JupyterHub, a hosted data science platform, or a multi-user research server.

AML.T0012

Exploitation

Attacker crafts an API request to jupyter-server's /api/contents endpoint with a path containing '../' sequences targeting a sibling directory whose name shares the root_dir prefix, bypassing the flawed startswith() boundary check in _get_os_path().

AML.T0049

Collection

Attacker reads or enumerates sensitive files from adjacent user workspaces or system directories — training datasets, model weights, API keys, SSH credentials, or proprietary notebooks stored outside the intended root.

AML.T0037

Impact

Stolen AI artifacts and credentials are exfiltrated, or attacker writes malicious notebook content to victim workspaces enabling follow-on training data poisoning, credential-based lateral movement, or code execution on the victim's next kernel start.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter	pip	—	No patch
13.3K OpenSSF 5.8 1.9K dependents Pushed 4d ago 56% patched ~28d to patch Full package profile →
Jupyter	pip	< 2.18.2	`2.18.2`
13.3K OpenSSF 5.8 1.9K dependents Pushed 4d ago 56% patched ~28d to patch Full package profile →
Jupyter Notebook	pip	—	No patch
13.3K OpenSSF 5.8 2.9K dependents Pushed 4d ago 64% patched ~264d to patch Full package profile →

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

1) Upgrade jupyter-server to a version beyond 2.17.0 — monitor the project GitHub releases for the patched build (reference: huntr.com bounty 24a36953). 2) For shared deployments, isolate each user's Jupyter root to a dedicated containerized or VM-based environment — do not rely solely on directory-level path checks. 3) Audit the directory structure around your Jupyter root for sensitive files reachable via sibling-directory traversal. 4) Implement filesystem-level ACLs (AppArmor or SELinux profiles) restricting the Jupyter process strictly to its intended root tree. 5) Monitor server access logs for requests to /api/contents containing '../' or percent-encoded traversal sequences in file path parameters.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Code Execution Framework Training Data AML.T0025 - Exfiltration via Cyber Means AML.T0035 - AI Artifact Collection AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.2 - Data for AI systems — security and integrity

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to inventory AI systems and manage associated risks

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-5422?

A path traversal flaw in jupyter-server 2.17.0 allows an authenticated user to read and write files outside the designated root directory by exploiting a missing trailing separator in the boundary check combined with unstripped '..' path components in the to_os_path() utility. In shared or multi-tenant Jupyter environments — common in AI/ML research clusters, data science platforms, and educational institutions — this means one user can access another's notebooks, training datasets, API keys, or model artifacts stored in adjacent directories. No CVSS score or EPSS data is published yet and no public exploit or KEV listing exists, but the attack primitive is classic path traversal requiring minimal skill from any authenticated user on a shared system. Upgrade jupyter-server beyond 2.17.0 immediately on any shared deployment; single-user containerized instances have significantly reduced exposure.

Is CVE-2026-5422 actively exploited?

No confirmed active exploitation of CVE-2026-5422 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-5422?

1) Upgrade jupyter-server to a version beyond 2.17.0 — monitor the project GitHub releases for the patched build (reference: huntr.com bounty 24a36953). 2) For shared deployments, isolate each user's Jupyter root to a dedicated containerized or VM-based environment — do not rely solely on directory-level path checks. 3) Audit the directory structure around your Jupyter root for sensitive files reachable via sibling-directory traversal. 4) Implement filesystem-level ACLs (AppArmor or SELinux profiles) restricting the Jupyter process strictly to its intended root tree. 5) Monitor server access logs for requests to /api/contents containing '../' or percent-encoded traversal sequences in file path parameters.

What systems are affected by CVE-2026-5422?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data science workspaces, agent frameworks, model development environments, MLOps platforms.

What is the CVSS score for CVE-2026-5422?

CVE-2026-5422 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

training pipelinesdata science workspacesagent frameworksmodel development environmentsMLOps platforms

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0035 AI Artifact Collection

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

Exploitation Scenario

An authenticated user on a shared JupyterHub deployment targets a colleague's workspace: they craft a request to the /api/contents endpoint with a path like '../jupyter-user-bob-workspace/../.env' or similar payload targeting a sibling directory whose name starts with the same prefix as the configured root_dir. The boundary check passes because 'startswith(root)' matches the prefix without validating the trailing separator boundary, and since '../' is not stripped from path components by to_os_path(), the traversal resolves to the adjacent directory. The attacker reads API keys, training data, or proprietary model artifacts from the victim workspace, or writes a malicious notebook that executes on the victim's next kernel start, enabling training data poisoning or credential-based lateral movement.

Weaknesses (CWE)

CWE-23 Relative Path Traversal Primary CWE-23 Relative Path Traversal Primary CWE-23 Relative Path Traversal

CWE-23 — Relative Path Traversal: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked. Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes: realpath() in C getCanonicalPath() in Java GetFullPath() in ASP.NET realpath() or abs_path() in Perl realpath() in PHP

Source: MITRE CWE corpus.