CVE-2026-54650

Received Received - Intake

Path Traversal in OpenHole Server

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-54650

Affected Vendors & Products

Vendor	Product	Version / Range
openhole	openhole-server	to 0.1.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

openhole-server in versions 0.1.1 and earlier forwards percent-encoded path segments like %2e and %2f directly to tunneled local services without decoding them. This allows attackers to bypass path restrictions by sending ../ or / sequences, enabling path traversal attacks on localhost services exposed to the internet.

Detection Guidance

This vulnerability allows path traversal via percent-encoded dot segments (%2e) and separators (%2f) in requests forwarded by openhole-server versions 0.1.1 and earlier. To detect it, inspect network traffic for requests containing %2e or %2f in paths forwarded to localhost services. Check openhole-server version with 'ophole-server --version' or examine running processes. If version is <=0.1.1, the system is vulnerable.

Impact Analysis

An attacker could access sensitive files or services running on your local machine by crafting malicious URLs that traverse directories. This could lead to unauthorized data access, service disruption, or further exploitation of local network services.

Compliance Impact

This vulnerability could violate data protection requirements by allowing unauthorized access to personal or sensitive data stored on local services. GDPR and HIPAA mandate strict access controls, and such breaches may result in compliance violations, fines, or legal consequences.

Mitigation Strategies

Update openhole-server to version 0.1.2 or later to fix the path traversal issue in the proxy component.

Hi! I’m here to help you understand CVE-2026-54650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70