CVE-2026-111093

7.5High

Published 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-23

Impact

Unauthenticated attackers can read arbitrary server files over the network. They only need HTTP access to the report blob endpoint.

Root cause

A path traversal vulnerability in the report blob endpoint fails to properly sanitize user-supplied file paths.

Affected systems

JetBrains Datalore versions prior to 2026.2.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade JetBrains Datalore to version 2026.2.1 or later. If upgrading must wait, restrict network access to the Datalore instance or block traffic to the report blob endpoint via reverse proxy.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: nvd.nist.gov/vuln/detail/CVE-2026-111093