{"id":"CVE-2026-5422","title":"jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability (CVE-2026-5422)","summary":"A flaw was found in jupyter-server. This path traversal vulnerability exists due to insufficient validation of file paths, specifically an incorrect root directory boundary check and improper handling of directory traversal sequences. This…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","affected":["migration_toolkit_for_applications 8.2","openshift_ai 3.3","openshift_ai 3.4"],"patched":["migration_toolkit_for_applications 8.2","openshift_ai 3.3","openshift_ai 3.4"],"published":"2026-06-02","updated":"2026-09-30","sourceUpdated":"2026-09-30T16:55:23+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5422.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5422.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-5422"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484037"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5422"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5422"},{"url":"https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"},{"url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"url":"https://access.redhat.com/errata/RHSA-2026:73987"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"url":"https://github.com/jupyter-server/jupyter_server"},{"url":"http://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.04858,"epssPercentile":0.91988,"aliases":["GHSA-gf7q-q4j7-hp7c"],"ecosystem":"pip","ingestedAt":"2026-07-10T13:49:10.786Z","slug":"CVE-2026-5422","body":"## Overview\n\nA flaw was found in jupyter-server. This path traversal vulnerability exists due to insufficient validation of file paths, specifically an incorrect root directory boundary check and improper handling of directory traversal sequences. This allows a remote attacker with low privileges to bypass directory restrictions and gain unauthorized read and write access to files in sibling directories. This could lead to the exposure of sensitive data, particularly in shared hosting environments.\n\n## Vendor advisories\n\n- **RHSA-2026:43038** · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:43038)\n- **RHSA-2026:73987** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73987)\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n\n**jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability** — rated Moderate by Red Hat. Released 2026-06-02, updated 2026-09-30.\n\nFixed:\n\n- Red Hat Migration Toolkit for Applications 8.2\n- Red Hat OpenShift AI 3.3\n- Red Hat OpenShift AI 3.4\n\nNot affected:\n\n- Red Hat Migration Toolkit for Applications 8.2\n- Red Hat OpenShift AI 3.3\n- Red Hat OpenShift AI 3.4\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:43038\nFor Red Hat OpenShift AI 3.3.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:73987\nFor Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60520\n\n## Package advisory (CVE-2026-5422)\n\nAffected packages:\n\n- `jupyter-server < 2.18.2`\n\nPatched in:\n\n- `jupyter-server 2.18.2`\n\nSource: https://osv.dev/vulnerability/GHSA-gf7q-q4j7-hp7c","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":37.4,"likelihood":1,"exploitation":0,"ransomware":0},"changes":[]}