CVE-2025-30167: Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

The vulnerability lies in Jupyter Core's handling of configuration file paths on Windows, specifically concerning the SYSTEM_CONFIG_PATH variable which can be derived from the %PROGRAMDATA% directory. If this directory has weak permissions, an attacker can place malicious configuration files that would be loaded by Jupyter processes, potentially leading to local privilege escalation. The function jupyter_core.paths.jupyter_config_path() is identified as the key vulnerable function because it assembles the list of search paths, including the potentially insecure SYSTEM_CONFIG_PATH. The provided patch (commit 0d225fda61f0edff01d1dfa826764482070dd8c3) modifies the logic in jupyter_core/paths.py to ensure that SYSTEM_CONFIG_PATH defaults to more secure alternatives (like ENV_CONFIG_PATH, which is typically sys.prefix/etc/jupyter) when the safety of using %PROGRAMDATA% cannot be guaranteed (e.g., when _use_programdata is false, or _win_programdata is not set). This change prevents jupyter_config_path() from returning a path list that includes an easily exploitable shared directory by default under vulnerable conditions. Any process using jupyter_config_path() to locate configuration files would have been susceptible.