CVE-2023-6569Critical· 9.3▾ MidnightExternal Control of File Name or Path in h2oai/h2o-3
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting as CSV.
h2o < 3.46.0.1Upgrade to a patched release:
h2o 3.46.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2024-10553Critical· 9.8H2O Deserialization of Untrusted Data Vulnerability
CVE-2024-5986Critical· 9.1H2O has an External Control of File Name or Path vulnerability
CVE-2025-6544Critical· 9.8A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code
CVE-2024-5550Medium· 5.3Arbitrary system path lookup in h20
CVE-2024-10549High· 7.5H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint
CVE-2024-10572High· 7.5H2O Vulnerable to Denial of Service (DoS) and File Write