[W 2026-05-22 18:33:13.512 ServerApp] ServerApp.token config is deprecated in 2.0. Use IdentityProvider.token.
[I 2026-05-22 18:33:13.526 ServerApp] jupyter_server_terminals | extension was successfully linked.
[W 2026-05-22 18:33:13.538 ServerApp] All authentication is disabled.  Anyone who can connect to this server will be able to run code.
[I 2026-05-22 18:33:13.539 ServerApp] jupyter_server_terminals | extension was successfully loaded.
[I 2026-05-22 18:33:13.541 ServerApp] Serving notebooks from local directory: /root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/data
[I 2026-05-22 18:33:13.541 ServerApp] Jupyter Server 2.17.0 is running at:
[I 2026-05-22 18:33:13.541 ServerApp] http://localhost:28930/
[I 2026-05-22 18:33:13.542 ServerApp]     http://127.0.0.1:28930/
[I 2026-05-22 18:33:13.542 ServerApp] Use Control-C to stop this server and shut down all kernels (twice to skip confirmation).
[E 2026-05-22 18:33:17.266 ServerApp] Uncaught exception GET /api/contents/%2e%2e%2fdatasecret (127.0.0.1)
    HTTPServerRequest(protocol='http', host='localhost:28930', method='GET', uri='/api/contents/%2e%2e%2fdatasecret', version='HTTP/1.1', remote_ip='127.0.0.1')
    Traceback (most recent call last):
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/tornado/web.py", line 1880, in _execute
        result = await result
                 ^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/auth/decorator.py", line 73, in inner
        return await out
               ^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/services/contents/handlers.py", line 148, in get
        if not cm.allow_hidden and await ensure_async(cm.is_hidden(path)):
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_core/utils/__init__.py", line 214, in ensure_async
        result = await obj
                 ^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/services/contents/filemanager.py", line 1095, in is_hidden
        return is_hidden(os_path, self.root_dir)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_core/paths.py", line 573, in is_hidden
        raise ValueError(_msg)
    ValueError: abs_path=PosixPath('/root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/datasecret') is not a subdirectory of abs_root=PosixPath('/root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/data'). abs_path must be within abs_root.
[W 2026-05-22 18:33:17.268 ServerApp] wrote error: 'Unhandled error'
    Traceback (most recent call last):
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/tornado/web.py", line 1880, in _execute
        result = await result
                 ^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/auth/decorator.py", line 73, in inner
        return await out
               ^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/services/contents/handlers.py", line 148, in get
        if not cm.allow_hidden and await ensure_async(cm.is_hidden(path)):
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_core/utils/__init__.py", line 214, in ensure_async
        result = await obj
                 ^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_server/services/contents/filemanager.py", line 1095, in is_hidden
        return is_hidden(os_path, self.root_dir)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/root/.pruva/runs/cve-2026-35397_20260522-180936/.jupyter_repro_venv/lib/python3.11/site-packages/jupyter_core/paths.py", line 573, in is_hidden
        raise ValueError(_msg)
    ValueError: abs_path=PosixPath('/root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/datasecret') is not a subdirectory of abs_root=PosixPath('/root/.pruva/runs/cve-2026-35397_20260522-180936/tmp_variant_test/data'). abs_path must be within abs_root.
[E 2026-05-22 18:33:17.268 ServerApp] {
      "Host": "localhost:28930",
      "Accept": "*/*",
      "User-Agent": "curl/8.5.0"
    }
[E 2026-05-22 18:33:17.268 ServerApp] 500 GET /api/contents/%2e%2e%2fdatasecret (06c6473c53534756a6755bfd2c380818@127.0.0.1) 2.97ms referer=None
[C 2026-05-22 18:33:17.271 ServerApp] received signal 15, stopping
[I 2026-05-22 18:33:17.271 ServerApp] Shutting down 1 extension