CVE-2026-59179

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59179", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-02T19:53:48.830Z", "datePublished": "2026-10-28T13:14:13.689Z", "dateUpdated": "2026-10-29T18:33:40.230Z"}, "containers": {"cna": {"title": "OpenHop: Path Traversal in Flow ID File Operations", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7"}, {"name": "https://github.com/naorsabag/openhop/pull/190", "tags": ["x_refsource_MISC"], "url": "https://github.com/naorsabag/openhop/pull/190"}, {"name": "https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4", "tags": ["x_refsource_MISC"], "url": "https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4"}, {"name": "https://github.com/naorsabag/openhop/releases/tag/v0.3.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/naorsabag/openhop/releases/tag/v0.3.7"}], "affected": [{"vendor": "naorsabag", "product": "openhop", "versions": [{"version": "< 0.3.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T13:14:13.689Z"}, "descriptions": [{"lang": "en", "value": "OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7."}], "source": {"advisory": "GHSA-g72f-jw3w-mgh7", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T18:33:12.643459Z", "id": "CVE-2026-59179", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T18:33:40.230Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59179", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T18:33:12.643459Z"}}}], "references": [{"url": "https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T18:33:31.629Z"}}], "cna": {"title": "OpenHop: Path Traversal in Flow ID File Operations", "source": {"advisory": "GHSA-g72f-jw3w-mgh7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "naorsabag", "product": "openhop", "versions": [{"status": "affected", "version": "< 0.3.7"}]}], "references": [{"url": "https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7", "name": "https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/naorsabag/openhop/pull/190", "name": "https://github.com/naorsabag/openhop/pull/190", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4", "name": "https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/naorsabag/openhop/releases/tag/v0.3.7", "name": "https://github.com/naorsabag/openhop/releases/tag/v0.3.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T13:14:13.689Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59179", "state": "PUBLISHED", "dateUpdated": "2026-10-29T18:33:40.230Z", "dateReserved": "2026-07-02T19:53:48.830Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T13:14:13.689Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openhop", "vendor": "naorsabag", "versions": [{"status": "affected", "version": "< 0.3.7"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7."}, {"lang": "es", "value": "OpenHop es una herramienta para crear diagramas de flujo de datos interactivos. Versiones anteriores a la 0.3.7, \u201c@openhop/server\u201d pasa par\u00e1metros de ruta de flujo no autenticados de \u201cGET /api/flows/:id\u201d y \u201cDELETE /api/flows/:id\u201d en \u201cpackages/server/src/routes.ts\u201d a \u201cFlowStore.filePath()\u201d en \u201cpackages/server/src/store.ts\u201d sin una lista de permitidos de identificadores. El router aplica \u201cdecodeURIComponent\u201d al ID, y \u201cpath.join()\u201d luego normaliza el recorrido fuera del directorio de flujo configurado despu\u00e9s de a\u00f1adir la extensi\u00f3n .yaml. Un atacante puede leer archivos YAML accesibles como JSON parseado de YAML o eliminar permanentemente archivos .yaml accesibles fuera de ese directorio, exponiendo configuraciones o secretos e interrumpiendo servicios dependientes. En \u201cpackages/server/src/index.ts\u201d, CORS \u201corigin: true\u201d permite cualquier origen de navegador, lo que permite a una p\u00e1gina web maliciosa atacar una instancia vinculada a loopback. Las implementaciones de Docker por defecto usan \u201cHOST=0.0.0.0\u201d y permiten acceso de red directo no autenticado. Este problema se ha corregido en la versi\u00f3n 0.3.7 del repositorio."}], "id": "CVE-2026-59179", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59179", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T18:33:12.643459Z", "version": "2.0.3"}}]}, "published": "2026-10-28T14:17:04.907", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4"}, {"source": "security-advisories@github.com", "url": "https://github.com/naorsabag/openhop/pull/190"}, {"source": "security-advisories@github.com", "url": "https://github.com/naorsabag/openhop/releases/tag/v0.3.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@openhop/server: @openhop/server: Arbitrary file deletion via path traversal in flow route parameters", "id": "2562863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562863"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.", "A flaw was found in @openhop/server. The application fails to properly validate flow identifiers received in route parameters before constructing file system paths. An unauthenticated attacker can exploit this flaw by sending crafted requests containing relative path sequences to access locations outside the intended storage directory, either directly over the network or indirectly through a malicious webpage abusing permissive Cross-Origin Resource Sharing (CORS) settings. Successful exploitation allows an attacker to permanently delete critical files or expose sensitive configuration files accessible to the application, resulting in data loss, service disruption, and information disclosure."], "name": "CVE-2026-59179", "public_date": "2026-10-28T13:14:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59179\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59179\nhttps://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4\nhttps://github.com/naorsabag/openhop/pull/190\nhttps://github.com/naorsabag/openhop/releases/tag/v0.3.7\nhttps://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7"], "statement": "Red Hat Product Security has rated this vulnerability as Important because an unauthenticated remote attacker can traverse directory paths to delete or view YAML files, posing significant threats to service availability and data integrity without requiring privileges. The elevated risk is driven by unauthenticated access combined with permissive cross-origin policies, which allow exploitation across the network or through third-party browser contexts. However, the @openhop/server component is not distributed or supported in Red Hat products, resulting in no direct impact on Red Hat environments.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.3.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "openhop", "source": "cna", "vendor": "naorsabag"}, "product": "openhop", "vendor": "naorsabag"}], "created": "2026-10-28T15:00:25.982141+00:00", "updated": "2026-10-28T21:46:43.593905+00:00", "vendors": ["naorsabag", "naorsabag$PRODUCT$openhop"]}