Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd1d19e58b advisory.

    New version fixing high-severity CVE.

    ----

    New version of jupyter-server fixing various security vulnerabilities.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9536c7cb79 advisory.

    New version of jupyter-server fixing various security vulnerabilities.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path
    traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and
    access sibling directories whose names begin with the same prefix as the root_dir. For example, with a
    root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted
    request to the /api/contents endpoint using encoded path components. An attacker can read, write, and
    delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes
    are particularly at risk, as a user with a directory named "user1" could access directories for user10
    through user19 and beyond. A user who can choose a single-character folder name could gain access to a
    significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder
    names do not share a common prefix with any sibling directory. (CVE-2026-35397)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path     traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and     access sibling directories whose names begin with the same prefix as the root_dir. For example, with a     root_dir named test, the API permits access to a sibling directory named testtest through a crafted     request to the /api/contents endpoint using encoded path components. An attacker can read, write, and     delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes     are particularly at risk, as a user with a directory named user1 could access directories for user10     through user19 and beyond. A user who can choose a single-character folder name could gain access to a     significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder     names do not share a common prefix with any sibling directory. (CVE-2026-35397)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325143	Fedora 44 : python-jupyter-server (2026-dd1d19e58b)	Nessus	Fedora Local Security Checks	high
323134	Fedora 43 : python-jupyter-server (2026-9536c7cb79)	Nessus	Fedora Local Security Checks	high
441557	SCA: security update for jupyter-server (GHSA-5789-5fc7-67v3)	Tenable Cloud Security	SCA Checks	high
441557	SCA: security update for jupyter-server (GHSA-5789-5fc7-67v3)	Tenable Self-Hosted Container Security	SCA Checks	high
312615	Linux Distros Unpatched Vulnerability : CVE-2026-35397	Nessus	Misc.	high

Detections

Analytics

CVE-2026-35397

high

Tenable Plugins

high

high

high

high

high