CVE-2026-59179
Deferred Deferred - Pending Action

Path Traversal in OpenHop Server

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-59179
EUVD
EUVD-2026-112080

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
naorsabag openhop < 0.3.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59179 is a Path Traversal vulnerability in OpenHop server (versions 0.3.5 and below). The server fails to validate flow ID parameters in GET and DELETE endpoints, allowing attackers to craft URLs with path traversal sequences like ..%2Fvictim. This bypasses directory restrictions, enabling reading or deleting arbitrary .yaml files outside the intended flow directory. The issue is worsened by CORS set to allow any origin and Docker deployments binding to 0.0.0.0 by default.

Detection Guidance

Check OpenHop server version with npm list @openhop/server. If version is below 0.3.7, the system is vulnerable. Inspect network traffic for requests to /api/flows/:id with path traversal sequences like ..%2Fvictim or ..%2Fetc%2Fpasswd. Monitor for unauthorized file reads or deletions in system logs.

Impact Analysis

An attacker could read sensitive YAML files containing configuration secrets or delete critical .yaml files, leading to data leaks or service disruption. The vulnerability allows unauthenticated access to read or delete files outside the configured flow directory. Docker deployments are particularly vulnerable as they permit direct remote exploitation.

Mitigation Strategies

Upgrade to OpenHop version 0.3.7 or later using npm update @openhop/server. If upgrading is not possible, restrict server access to trusted networks only and disable CORS origin: true by setting allowed origins to localhost and 127.0.0.1. Block external access to port 3000 or the server's listening port if running in Docker.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart