{
  "cve_id": "CVE-2026-35397",
  "advisory_id": "GHSA-5789-5fc7-67v3",
  "vulnerability_type": "Path Traversal (faulty startswith() containment check)",
  "affected_versions": "<= 2.17.0",
  "fixed_versions": ["2.18.0"],
  "reproduction_status": "confirmed",
  "vulnerable_version_tested": "2.17.0",
  "fixed_version_tested": "2.18.0",
  "reproduction_method": "HTTP API exploitation via /api/contents/%2e%2e%2fdatasecret/secret.txt with ContentsManager.allow_hidden=True",
  "vulnerable_indicator": "HTTP 200 with secret file contents exposed in JSON response body",
  "fixed_indicator": "HTTP 404 with 'file or directory ... does not exist' message",
  "script": "repro/reproduction_steps.sh",
  "logs": {
    "vulnerable": {
      "server_log": "logs/vulnerable.log",
      "http_body": "logs/vulnerable_http_body.json",
      "manifest": "logs/vulnerable_manifest.json"
    },
    "fixed": {
      "server_log": "logs/fixed.log",
      "http_body": "logs/fixed_http_body.json",
      "manifest": "logs/fixed_manifest.json"
    }
  },
  "idempotent": true,
  "environment": {
    "python": "3.11.15",
    "platform": "Linux x86_64",
    "pip": "24.0"
  }
}