Vulnerability-Lookup

CVE-2025-30167 (GCVE-0-2025-30167)

Vulnerability from cvelistv5 – Published: 2025-06-03 16:42 – Updated: 2026-01-23 16:31

Title

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Summary

Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).

Severity ?

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

GitHub_M

References

URL

Tags

	https://github.com/jupyter/jupyter_core/security/…	x_refsource_CONFIRM
	https://github.com/jupyter/jupyter_core/commit/5e…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	jupyter	jupyter_core	Affected: < 5.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-03T17:34:39.597862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T17:34:46.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyter_core",
          "vendor": "jupyter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-23T16:31:03.690Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq"
        },
        {
          "name": "https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52"
        }
      ],
      "source": {
        "advisory": "GHSA-33p9-3p43-82vq",
        "discovery": "UNKNOWN"
      },
      "title": "Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-30167",
    "datePublished": "2025-06-03T16:42:16.357Z",
    "dateReserved": "2025-03-17T12:41:42.568Z",
    "dateUpdated": "2026-01-23T16:31:03.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-30167\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-03T17:34:39.597862Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-03T17:34:42.419Z\"}}], \"cna\": {\"title\": \"Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability\", \"source\": {\"advisory\": \"GHSA-33p9-3p43-82vq\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"jupyter\", \"product\": \"jupyter_core\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.8.0\"}]}], \"references\": [{\"url\": \"https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq\", \"name\": \"https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52\", \"name\": \"https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\\\\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-427\", \"description\": \"CWE-427: Uncontrolled Search Path Element\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-23T16:31:03.690Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-30167\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-23T16:31:03.690Z\", \"dateReserved\": \"2025-03-17T12:41:42.568Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-06-03T16:42:16.357Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-33P9-3P43-82VQ

Vulnerability from github – Published: 2025-06-04 21:00 – Updated: 2026-01-23 16:31

Summary

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Details

Impact

On Windows, the shared %PROGRAMDATA% directory is searched for configuration files (SYSTEM_CONFIG_PATH and SYSTEM_JUPYTER_PATH), which may allow users to create configuration files affecting other users.

Only shared Windows systems with multiple users and unprotected %PROGRAMDATA% are affected.

Mitigations

upgrade to jupyter_core>=5.8.1 (5.8.0 is patched but breaks jupyter-server) , or
as administrator, modify the permissions on the %PROGRAMDATA% directory so it is not writable by unauthorized users, or
as administrator, create the %PROGRAMDATA%\jupyter directory with appropriately restrictive permissions, or
as user or administrator, set the %PROGRAMDATA% environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators or the current user)

Credit

Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932

Severity ?

7.3 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 5.8.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyter_core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-30167"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-427"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-04T21:00:23Z",
    "nvd_published_at": "2025-06-03T17:15:21Z",
    "severity": "HIGH"
  },
  "details": "## Impact\n\nOn Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.\n\nOnly shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.\n\n## Mitigations\n\n- upgrade to `jupyter_core\u003e=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or\n- as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or\n- as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions, or\n- as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)\n\n## Credit\n\nReported via Trend Micro Zero Day Initiative as ZDI-CAN-25932",
  "id": "GHSA-33p9-3p43-82vq",
  "modified": "2026-01-23T16:31:13Z",
  "published": "2025-06-04T21:00:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30167"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyter/jupyter_core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability"
}

FKIE_CVE-2025-30167

Vulnerability from fkie_nvd - Published: 2025-06-03 17:15 - Updated: 2026-01-23 17:16

Severity ?

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52
	security-advisories@github.com	https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq	Vendor Advisory

Impacted products

	Vendor	Product	Version
	jupyter	jupyter_core	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jupyter:jupyter_core:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5D80A0D-E7CC-477C-A9A8-AEEAA86D47E5",
              "versionEndExcluding": "5.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)."
    },
    {
      "lang": "es",
      "value": "Jupyter Core es un paquete para la funcionalidad principal com\u00fan de los proyectos de Jupyter. Al usar Jupyter Core antes de la versi\u00f3n 5.8.0 en Windows, se buscan archivos de configuraci\u00f3n (`SYSTEM_CONFIG_PATH` y `SYSTEM_JUPYTER_PATH`) en el directorio compartido `%PROGRAMDATA%`, lo que puede permitir que los usuarios creen archivos de configuraci\u00f3n que afecten a otros usuarios. Solo se ven afectados los sistemas Windows compartidos con varios usuarios y `%PROGRAMDATA%` sin protecci\u00f3n. Los usuarios deben actualizar a Jupyter Core versi\u00f3n 5.8.0 o posterior para recibir un parche. Hay otras mitigaciones disponibles. Como administrador, modifique los permisos del directorio `%PROGRAMDATA%` para que usuarios no autorizados no puedan escribir en \u00e9l; o como administrador, cree el directorio `%PROGRAMDATA%\\jupyter` con los permisos restrictivos adecuados. o como usuario o administrador, configure la variable de entorno `%PROGRAMDATA%` en un directorio con permisos restrictivos apropiados (por ejemplo, controlado por administradores _o_ el usuario actual)."
    }
  ],
  "id": "CVE-2025-30167",
  "lastModified": "2026-01-23T17:16:06.480",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-06-03T17:15:21.520",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-30167 (GCVE-0-2025-30167)

GHSA-33P9-3P43-82VQ

Impact

Mitigations

Credit

FKIE_CVE-2025-30167

Tags

Sightings

Nomenclature