THREAT OPS › Threat News › [GHSA] GHSA-g72f-jw3w-mgh7 (high) — @openhop/server: Path Traversal in Flow ID File Operations
[GHSA] GHSA-g72f-jw3w-mgh7 (high) — @openhop/server: Path Traversal in Flow ID File Operations
GHSA-g72f-jw3w-mgh7 Severity: high CVE: CVE-2026-59179
@openhop/server: Path Traversal in Flow ID File Operations
## Path Traversal in Flow ID File Operations
### Summary
`@openhop/server` passes unsanitized HTTP route parameters directly to `path.join()` when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary `.yaml` file
Indicators of compromise
- CVE-2026-59179cve
- http://127.0.0.1:8799/api/flows/..%2Fvictimurl
- http://127.0.0.1:8799/api/flows/..%2Fdelete-meurl
- http://{host}:{port}url
- http://{HOST}:{PORT}url
Original source: https://github.com/advisories/GHSA-g72f-jw3w-mgh7