CVE-2023-40170

jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.

• CWE-284
• CWE-306
• CWE-79

• https://github.com/jupyter-server/jupyter_server/commit/87a4927272819f0b1cae1afa4c8c86ee2da002fdPatch
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-64x5-55rw-9974Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRP7DNZYVOIA4ZB3U3ZWKTFZEPYWNGCQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XDKQAWQN6SQTOVACZNXYKEHWQXGG4DOF/
• https://github.com/jupyter-server/jupyter_server/commit/87a4927272819f0b1cae1afa4c8c86ee2da002fdPatch
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-64x5-55rw-9974Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRP7DNZYVOIA4ZB3U3ZWKTFZEPYWNGCQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XDKQAWQN6SQTOVACZNXYKEHWQXGG4DOF/

Published

Aug 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40164Notepad++ is a free and open-source source code editor. Vers…5.5
• CVE-2023-40165rubygems.org is the Ruby community's primary gem (library) h…7.5
• CVE-2023-40166Notepad++ is a free and open-source source code editor. Vers…5.5
• CVE-2023-40167Jetty is a Java based web server and servlet engine. Prior t…5.3
• CVE-2023-40168TurboWarp is a desktop application that compiles scratch pro…6.5
• CVE-2023-4017The Goya theme for WordPress is vulnerable to Reflected Cros…6.1
• CVE-2023-40171Dispatch is an open source security incident management tool…7.5
• CVE-2023-40172Social media skeleton is an uncompleted/framework social med…8.8
• CVE-2023-40173Social media skeleton is an uncompleted/framework social med…7.5
• CVE-2023-40174Social media skeleton is an uncompleted/framework social med…9.8
• CVE-2023-40175Puma is a Ruby/Rack web server built for parallelism. Prior …9.8
• CVE-2023-40176XWiki Platform is a generic wiki platform offering runtime s…5.4