UBUNTU-CVE-2026-35397

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-35397

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35397.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-35397

Upstream

CVE-2026-35397

Published

2026-05-05T20:16:00Z

Modified

2026-05-20T16:25:36.746018628Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured rootdir and access sibling directories whose names begin with the same prefix as the rootdir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory.

References

Affected packages

Ubuntu:22.04:LTS / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/ubuntu/jupyter-server?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.2-1

1.13.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jupyter-server",
            "binary_version": "1.13.1-1"
        },
        {
            "binary_name": "python3-jupyter-server",
            "binary_version": "1.13.1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35397.json"

Ubuntu:24.04:LTS / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/ubuntu/jupyter-server?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.23.3-1

1.23.3-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jupyter-server",
            "binary_version": "1.23.3-2"
        },
        {
            "binary_name": "python3-jupyter-server",
            "binary_version": "1.23.3-2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35397.json"

Ubuntu:25.10 / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/ubuntu/jupyter-server?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.14.2-5

2.15.0-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jupyter-server",
            "binary_version": "2.15.0-1"
        },
        {
            "binary_name": "python3-jupyter-server",
            "binary_version": "2.15.0-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35397.json"

Ubuntu:26.04:LTS / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/ubuntu/jupyter-server?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.15.0-1

2.17.0-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jupyter-server",
            "binary_version": "2.17.0-1"
        },
        {
            "binary_name": "python3-jupyter-server",
            "binary_version": "2.17.0-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35397.json"