CVE-2026-54528CWE-178

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

High · published July 8, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.2th percentile
Weakness
CWE-178 · Improper Handling of Case Sensitivity
Published
2026-07-08T21:04Z
EPSS history
Timeline
  • 08 JUL 21:04Z
    jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
    cvelistv5