Loading story…
A high-severity path traversal flaw tracked as CVE-2026-54650 was disclosed in the openhole project, affecting openhole-server and the CLI client in versions 0.1.1 and earlier. The bug stemmed from improper handling of request paths in the proxy chain: the server forwarded r.URL.Path instead of preserving the original escaped request target, while client-side proxy code constructed backend URLs in a way that let attacker-controlled paths pass through to local services. As a result, percent-encoded traversal sequences such as %2e and %2f could be interpreted as ../ and /, enabling remote access to unintended files.
The vulnerability is classified as CWE-22 with a CVSS 3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating high confidentiality impact without requiring authentication or user interaction. Reported attack paths included requests such as /../../etc/passwd and encoded equivalents routed through the proxy to tunneled local backends. The issue was fixed in openhole version 0.1.2 by switching the server to r.URL.EscapedPath() and updating the client to build requests with a structured url.URL object that preserves RawPath and safely decodes Path.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
The path traversal vulnerability affecting openhole-server and the openhole CLI client was remediated in openhole version 0.1.2. The fix changed server path handling to use r.URL.EscapedPath() and updated the client to construct backend requests safely with a structured url.URL object.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity path traversal vulnerability tracked as **`CVE-2026-55629`** was disclosed in **Whistle**, the HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. The flaw affects versions prior to **`2.10.3`** and stems from the **`/cgi-bin/temp/get`** handler in `lib/service/service.js`, which passed a user-controlled filename directly to file retrieval logic. An unauthenticated remote attacker could exploit the issue without user interaction to read arbitrary files on the host, including sensitive system files such as `/etc/passwd`. The issue received a **CVSS 4.0 score of 8.7** and was addressed in Whistle **`2.10.3`**, with public references pointing to the project release, a fixing commit, and a GitHub security advisory. Subsequent project changes also show broader hardening in Whistle's service and temporary-file handling, including centralized temp-file utilities and a UID-based authorization check for service endpoints, alongside other fixes to proxy authorization, parsing, and plugin-related logic.
Jul 17, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2026-35392** and **CVE-2026-35393**, were disclosed in **goshs**, a Go-based SimpleHTTPServer, affecting versions prior to **`2.0.0-beta.3`**. Both issues are classified as **CWE-22 path traversal** flaws that arise from missing pathname sanitization in file upload functionality: **PUT** upload handling in `httpserver/updown.go` and **POST multipart** upload directory processing. The weaknesses could allow remote, unauthenticated attackers to write files outside intended directories. Both CVEs carry the same **CVSS v3** vector, **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating high impact to confidentiality, integrity, and availability. The vulnerabilities were addressed in **`2.0.0-beta.3`**, and related GitHub security advisories were published alongside the fixes. Organizations using goshs for file upload workflows should prioritize upgrading and review exposed instances for unauthorized file placement or tampering.
Jun 29, 2026