PyPI/jupyter-server CVE-2026-5422: medium 6.8, EPSS 0.55%

Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

Action: Upgrade jupyter-server to 2.18.2 or later.

pip install jupyter-server==2.18.2

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2532
• https://nvd.nist.gov/vuln/detail/CVE-2026-5422
• https://github.com/jupyter-server/jupyter_server
• https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f
• http://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2
• https://pypi.org/project/jupyter-server
• https://github.com/advisories/GHSA-gf7q-q4j7-hp7c

CVE-2026-5422 · published 2026-07-13T15:46:13.935289Z · modified 2026-07-13T16:31:58.966038327Z · JSON