[W 2026-05-22 18:31:28.734 ServerApp] ServerApp.token config is deprecated in 2.0. Use IdentityProvider.token.
[I 2026-05-22 18:31:28.748 ServerApp] jupyter_server_terminals | extension was successfully linked.
[W 2026-05-22 18:31:28.760 ServerApp] All authentication is disabled.  Anyone who can connect to this server will be able to run code.
[I 2026-05-22 18:31:28.761 ServerApp] jupyter_server_terminals | extension was successfully loaded.
[I 2026-05-22 18:31:28.764 ServerApp] The port 28910 is already in use, trying another port.
[I 2026-05-22 18:31:28.764 ServerApp] Serving notebooks from local directory: /root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/data
[I 2026-05-22 18:31:28.764 ServerApp] Jupyter Server 2.17.0 is running at:
[I 2026-05-22 18:31:28.764 ServerApp] http://localhost:28911/
[I 2026-05-22 18:31:28.764 ServerApp]     http://127.0.0.1:28911/
[I 2026-05-22 18:31:28.764 ServerAp[E 2026-05-22 18:31:32.445 ServerApp] Uncaught exception GET /api/contents/%2e%2e%2fdatasecret/secret.txt?content=1 (127.0.0.1)
    HTTPServerRequest(protocol='http', host='localhost:28910', method='GET', uri='/api/contents/%2e%2e%2fdatasecret/secret.txt?content=1', version='HTTP/1.1', remote_ip='127.0.0.1')
    Traceback (most recent call last):
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/tornado/web.py", line 1880, in _execute
        result = await result
                 ^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/auth/decorator.py", line 73, in inner
        return await out
               ^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/services/contents/handlers.py", line 148, in get
        if not cm.allow_hidden and await ensure_async(cm.is_hidden(path)):
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_core/utils/__init__.py", line 214, in ensure_async
        result = await obj
                 ^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/services/contents/filemanager.py", line 1095, in is_hidden
        return is_hidden(os_path, self.root_dir)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_core/paths.py", line 573, in is_hidden
        raise ValueError(_msg)
    ValueError: abs_path=PosixPath('/root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/datasecret/secret.txt') is not a subdirectory of abs_root=PosixPath('/root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/data'). abs_path must be within abs_root.
[W 2026-05-22 18:31:32.447 ServerApp] wrote error: 'Unhandled error'
    Traceback (most recent call last):
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/tornado/web.py", line 1880, in _execute
        result = await result
                 ^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/auth/decorator.py", line 73, in inner
        return await out
               ^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/services/contents/handlers.py", line 148, in get
        if not cm.allow_hidden and await ensure_async(cm.is_hidden(path)):
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_core/utils/__init__.py", line 214, in ensure_async
        result = await obj
                 ^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/services/contents/filemanager.py", line 1095, in is_hidden
        return is_hidden(os_path, self.root_dir)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_core/paths.py", line 573, in is_hidden
        raise ValueError(_msg)
    ValueError: abs_path=PosixPath('/root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/datasecret/secret.txt') is not a subdirectory of abs_root=PosixPath('/root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/data'). abs_path must be within abs_root.
[E 2026-05-22 18:31:32.447 ServerApp] {
      "Host": "localhost:28910",
      "Accept": "*/*",
      "User-Agent": "curl/8.5.0"
    }
[E 2026-05-22 18:31:32.447 ServerApp] 500 GET /api/contents/%2e%2e%2fdatasecret/secret.txt?content=1 (316e3e4ef85043e38e8ee45befa88d29@127.0.0.1) 3.61ms referer=None