Path Traversal in JupyterLab Git Extension

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-54528

Affected Vendors & Products

Vendor	Product	Version / Range
jupyterlab_git	jupyterlab_git	to 0.54.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the JupyterLab Git extension prior to version 0.54.0. It involves the use of the fnmatch.fnmatchcase() function in the GitHandler.prepare() method to enforce excluded paths. On case-insensitive filesystems, an authenticated user can exploit this by varying the casing of URL paths to bypass the exclusion rules and gain access to directories that should be excluded.

Impact Analysis

An authenticated user could exploit this vulnerability to read directories that are meant to be excluded from access. This could lead to unauthorized disclosure of sensitive information stored in those directories, potentially compromising confidentiality.

Mitigation Strategies

To mitigate this vulnerability, upgrade jupyterlab-git to version 0.54.0 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54528. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70