Description
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.
Published: 2026-10-28
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: Unauthorized File Access and Deletion via Path Traversal
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows an attacker to manipulate the flow identifier in GET or DELETE requests to the OpenHop server. Because the identifier is decoded and joined to the flow directory without a whitelist, the server normalizes paths that can point outside the intended directory. This enables reading or permanently deleting YAML configuration files that may contain sensitive data or disrupt dependent services.

Affected Systems

All releases of naorsabag OpenHop installed before version 0.3.7 are affected. The fix is available in the 0.3.7 release and later.

Risk and Exploitability

The flaw carries a CVSS score of 8.3, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker does not need authentication; the server supports CORS with any origin, and typical Docker deployments expose the service on 0.0.0.0, making it reachable over the network. A malicious webpage can thus target a loopback‑bound instance or a publicly exposed instance to exploit the omission of an identifier whitelist, gaining read or delete capabilities on configuration files.

Generated by OpenCVE AI on October 28, 2026 at 14:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OpenHop to version 0.3.7 or later to obtain the official patch for the traversal flaw.
  • If an upgrade cannot be applied immediately, bind the OpenHop server to a private interface or localhost and enforce firewall rules to block external access.
  • Reconfigure the CORS policy to restrict origins to trusted domains and consider adding authentication to the API endpoints to prevent unauthenticated access.

Generated by OpenCVE AI on October 28, 2026 at 14:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-g72f-jw3w-mgh7 @openhop/server: Path Traversal in Flow ID File Operations
History

Wed, 28 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.
Title OpenHop: Path Traversal in Flow ID File Operations
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T13:14:13.689Z

Reserved: 2026-07-02T19:53:48.830Z

Link: CVE-2026-59179

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-28T14:17:04.907

Modified: 2026-10-28T15:24:56.033

Link: CVE-2026-59179

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T15:00:25Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')