CVE-2026-35397 | jupyter-server jupyter_server up to 2.17.x REST API /api/contents path traversal (EUVD-2026-27470)

A vulnerability marked as critical has been reported in jupyter-server jupyter_server up to 2.17.x. Affected is an unknown function of the file /api/contents of the component REST API. Performing a manipulation results in path traversal. This vulnerability is cataloged as CVE-2026-35397. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.