openhole-server, for releases 0.1.1 and earlier, forwards r.URL.Path instead of the original escaped path r.URL.EscapedPath() in its public_proxy handler. This allows an attacker to include percent‑encoded dot and slash characters that are decoded to "../" and "/" and thus traverse directories or reach services that the proxy forwards to local services on the host. The flaw enables a remote user who can send a crafted HTTP request to the exposed proxy to access internal services or files that should otherwise be inaccessible, violating confidentiality and potentially allowing further exploitation.

The vendor bablilayoub hosts openhole, a tool that can expose localhost to the internet via a single command. Versions 0.1.1 and earlier of openhole-server are affected. The fix was introduced in release v0.1.2, which now uses r.URL.EscapedPath() and removes the vulnerability.

The CVSS score of 8.6 classifies the vulnerability as high severity. The EPSS score is less than 1%, indicating a low current exploitation probability, and it is not listed in CISA’s KEV catalog. The attack vector is inferred to be an HTTP(S) request directly to the exposed proxy endpoint. Once the attacker reaches the proxy with a crafted URL, the path traversal can be exercised immediately, making the vulnerability readily exploitable on any system where openhole is launched with public internet access.