CVE-2026-35397 | jupyter-server jupyter_server up to 2.17.x REST API /api/contents path traversal

A vulnerability marked as critical has been reported in jupyter-server jupyter_server up to 2.17.x. Affected is an unknown function of the file /api/contents of the component REST API. Performing a manipulation results in path traversal.

This vulnerability is cataloged as CVE-2026-35397. It is possible to initiate the attack remotely. There is no exploit available.

It is suggested to upgrade the affected component.