CVE-2024-5986
Unknown Unknown - Not Provided
Arbitrary File Write in h2o-3 Enables Remote Code Execution

Publication date: 2026-02-02

Last updated on: 2026-02-02

Assigner: huntr.dev

Description
A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the `/3/Frames/framename/export` endpoint. The impact of this vulnerability includes the potential for remote code execution and complete access to the system running h2o-3, as attackers can overwrite critical files such as private SSH keys or script files.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-02
Last Modified
2026-02-02
Generated
2026-06-16
AI Q&A
2026-02-02
EPSS Evaluated
2026-06-14
NVD
CVE-2024-5986
EUVD
EUVD-2024-55393
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
h2oai h2o-3 3.46.0.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the /3/Frames/framename/export endpoint.

Impact Analysis

The vulnerability can lead to remote code execution and complete access to the system running h2o-3, as attackers can overwrite critical files such as private SSH keys or script files.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-5986. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart