CVE-2026-111093: Path Traversal
Published Oct 15, 2026
·Updated
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
Affected Software
1 affected component
JetBrains Datalore<2026.2.1
Event History
Oct 15, 2026
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Datalore deployments are affected?
JetBrains Datalore versions before 2026.2.1 are affected. The issue is exposed through the report blob endpoint.
2
Does exploitation require an account or user interaction?
No. The vulnerability is unauthenticated and can be exploited remotely without user interaction.
3
What could an attacker obtain through this issue?
An attacker could use path traversal through the report blob endpoint to read arbitrary files accessible to the Datalore service.