A AegiFlow
CRITICALCVSS 9.3EPSS 0.7%

CVE-2023-6569

External Control of File Name or Path in h2oai/h2o-3

Published
2023-12-14
Modified
2026-10-27
EPSS percentile
54%
Aliases
GHSA-gqrq-j6pm-98c2
Sources
github-advisory

Summary

Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting as CSV.

Affected packages

EcosystemPackageAffected versionsFixed versions
PyPIh2o—3.46.0.1

Remediation: Upgrade to 3.46.0.1 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.