JetBrains Datalore before 2026.2.1 contains a path traversal flaw in the report blob endpoint. An unauthenticated attacker can craft a request that resolves to arbitrary file paths on the server, allowing the attacker to read files that should be protected. This leads to information disclosure and could expose sensitive configuration, credentials, or source code. The weakness corresponds to CWE-23, a classic directory traversal vulnerability.

JetBrains Datalore products released prior to version 2026.2.1 are affected. Users running these versions of Datalore without applying the recommended update may be exposed to the traversal flaw.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% shows that historical exploitation is rare, and the vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited in the wild. The flaw is remotely exploitable without authentication, so any user who can reach the exposed endpoint could potentially read any file on the server. Because the attack requires no special credentials and depends on simple URL manipulation, the risk of exploitation remains significant for exposed installations.