---
id: CVE-2025-30167
aliases:
  - GHSA-33p9-3p43-82vq
  - PYSEC-2026-1477
title: >-
  Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege
  Escalation Vulnerability
summary: >-
  Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege
  Escalation Vulnerability
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'
vendor: jupyter-core
product: jupyter-core
ecosystem: pip
affected:
  - jupyter-core < 5.8.1
patched:
  - jupyter-core 5.8.1
published: '2025-06-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:24.754946270Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-33p9-3p43-82vq'
references:
  - url: >-
      https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-30167'
  - url: >-
      https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52
  - url: 'https://github.com/jupyter/jupyter_core'
tags:
  - osv
  - pip
epss: 0.00186
epssPercentile: 0.07195
ingestedAt: '2026-07-08T18:25:44.661Z'
---

## Overview

## Impact

On Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.

Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.

## Mitigations

- upgrade to `jupyter_core>=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or
- as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or
- as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions, or
- as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)

## Credit

Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932

## Affected packages

- `jupyter-core < 5.8.1`

## Remediation

Upgrade to a patched release:

- `jupyter-core 5.8.1`