Medium [CVE-2026-54528] Information disclosure via case-sensitivity bypass in excluded path enforcement

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories.

This issue is fixed in version 0.54.0. This vulnerability allows an authenticated user on a case-insensitive filesystem to bypass administrator-configured excluded paths by varying the case of the URL path segment.

This bypass enables the user to read file content, view git status, logs, and diffs, and enumerate commits within directories that were intended to be excluded. The root cause is the unconditional case-sensitivity of the `fnmatch.fnmatchcase()` function used for path enforcement, which does not normalize paths for case-insensitive platforms.

This Moderate impact flaw in JupyterLab Git, as deployed in Red Hat OpenShift AI, allows an authenticated user to bypass administrator-defined path exclusions on case-insensitive filesystems.

By manipulating the casing of URL path segments, an attacker can gain unauthorized read access to sensitive Git repository information, including file content and commit history, from directories intended to be protected. This bypass occurs because the path enforcement mechanism does not account for filesystem case-insensitivity.