Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59179— OpenHop: Path Traversal in Flow ID File Operations

Quick assessment

Affected
naorsabag openhop
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenHop 是一款用于创建交互式数据流图的工具。在 0.3.7 版本之前， 在 中处理 和 请求时，会将未经身份验证的流路由参数直接传递给 中的 方法，且未实施标识符白名单机制。路由器会对 参数执行 解码，随后 在追加 扩展名后对路径进行规范化处理，从而允许路径遍历至配置的流目录之外。攻击者可借此读取可访问的 YAML 文件（以 YAML 解析后的 JSON 格式返回），或永久删除该目录外的可访问 文件，导致配置信息或敏感密钥泄露，并破坏依赖服务的正常运行。此外，在 中，CORS 配置 允许任意浏览器来源，使得

CVSS 8.3 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59179

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenHop: Path Traversal in Flow ID File Operations
Source: CVE Program / CVE List V5
Vulnerability Description
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
naorsabag openhop < 0.3.7 -

II. Public POCs for CVE-2026-59179

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59179

请登录查看更多情报信息。

Other References for CVE-2026-59179 (4)

IV. Related Vulnerabilities

Same weakness: CWE-22