Vulnerability-Lookup

CVE-2026-54650 (GCVE-0-2026-54650)

Vulnerability from cvelistv5 – Published: 2026-07-28 22:20 – Updated: 2026-07-29 14:21

Title

openhole-server vulnerable to path traversal via URL-decoded request path

Summary

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-29 14:21 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/bablilayoub/openhole/security/…	x_refsource_CONFIRM
https://github.com/bablilayoub/openhole/commit/a2…	x_refsource_MISC
https://github.com/bablilayoub/openhole/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
bablilayoub	openhole	Affected: < 0.1.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T14:21:27.402734Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T14:21:36.367Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openhole",
          "vendor": "bablilayoub",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T22:20:36.566Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc"
        },
        {
          "name": "https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3"
        },
        {
          "name": "https://github.com/bablilayoub/openhole/releases/tag/v0.1.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bablilayoub/openhole/releases/tag/v0.1.2"
        }
      ],
      "source": {
        "advisory": "GHSA-fh2f-xfxc-q9cc",
        "discovery": "UNKNOWN"
      },
      "title": "openhole-server vulnerable to path traversal via URL-decoded request path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54650",
    "datePublished": "2026-07-28T22:20:36.566Z",
    "dateReserved": "2026-06-15T20:16:46.198Z",
    "dateUpdated": "2026-07-29T14:21:36.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54650",
      "date": "2026-09-15",
      "epss": "0.00361",
      "percentile": "0.29535"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54650\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-28T23:17:08.763\",\"lastModified\":\"2026-09-10T20:05:05.293\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"bablilayoub\",\"product\":\"openhole\",\"versions\":[{\"version\":\"\u003c 0.1.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-29T14:21:27.402734Z\",\"id\":\"CVE-2026-54650\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/bablilayoub/openhole/releases/tag/v0.1.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc\",\"source\":\"security-advisories@github.com\"}]}}",
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-05T00:31:41Z",
      "cve": "CVE-2026-54650",
      "id": "CVE-2026-54650",
      "initial_release_date": "2026-09-05T00:31:41Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-54650",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-54650.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54650\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-29T14:21:27.402734Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-29T14:21:32.917Z\"}}], \"cna\": {\"title\": \"openhole-server vulnerable to path traversal via URL-decoded request path\", \"source\": {\"advisory\": \"GHSA-fh2f-xfxc-q9cc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"bablilayoub\", \"product\": \"openhole\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.1.2\"}]}], \"references\": [{\"url\": \"https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc\", \"name\": \"https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3\", \"name\": \"https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/bablilayoub/openhole/releases/tag/v0.1.2\", \"name\": \"https://github.com/bablilayoub/openhole/releases/tag/v0.1.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-28T22:20:36.566Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54650\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-29T14:21:36.367Z\", \"dateReserved\": \"2026-06-15T20:16:46.198Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-28T22:20:36.566Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54650

Vulnerability from fkie_nvd - Published: 2026-07-28 23:17 - Updated: 2026-09-10 20:05

Severity

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3
	security-advisories@github.com	https://github.com/bablilayoub/openhole/releases/tag/v0.1.2
	security-advisories@github.com	https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "openhole",
          "vendor": "bablilayoub",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2."
    }
  ],
  "id": "CVE-2026-54650",
  "lastModified": "2026-09-10T20:05:05.293",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54650",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-29T14:21:27.402734Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-28T23:17:08.763",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bablilayoub/openhole/releases/tag/v0.1.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FH2F-XFXC-Q9CC

Vulnerability from github – Published: 2026-07-28 22:20 – Updated: 2026-07-28 22:20

Summary

openhole-server vulnerable to path traversal via URL-decoded request path

Details

Summary

openhole-server forwarded the URL-decoded request path (r.URL.Path) to tunnel clients instead of the original request-target. Percent-encoded dot-segments (%2e) and separators (%2f) were decoded to ../ and / before reaching the local service.

Go's ServeMux rejects literal ../ paths, but percent-encoded traversal sequences bypassed this and were delivered to backends as working path traversal.

Impact

An unauthenticated remote attacker could read files outside the published web root on tunneled local services that resolve paths without canonicalization.

Example: - /%2e%2e/secret.txt → file outside web root - /%2e%2e/%2e%2e/etc/passwd → sensitive files

Encoded slashes (/a%2fb) could also bypass path-based access controls.

Fix

v0.1.2 forwards r.URL.EscapedPath() on the server and preserves the request-target on the CLI client.

Users should upgrade both openhole-server and the openhole CLI to v0.1.2 or later.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/bablilayoub/openhole"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54650"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T22:20:51Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nopenhole-server forwarded the URL-decoded request path (`r.URL.Path`) to tunnel clients instead of the original request-target. Percent-encoded dot-segments (`%2e`) and separators (`%2f`) were decoded to `../` and `/` before reaching the local service.\n\nGo\u0027s ServeMux rejects literal `../` paths, but percent-encoded traversal sequences bypassed this and were delivered to backends as working path traversal.\n\n## Impact\n\nAn unauthenticated remote attacker could read files outside the published web root on tunneled local services that resolve paths without canonicalization.\n\nExample:\n- `/%2e%2e/secret.txt` \u2192 file outside web root\n- `/%2e%2e/%2e%2e/etc/passwd` \u2192 sensitive files\n\nEncoded slashes (`/a%2fb`) could also bypass path-based access controls.\n\n## Fix\n\nv0.1.2 forwards `r.URL.EscapedPath()` on the server and preserves the request-target on the CLI client.\n\nUsers should upgrade both openhole-server and the openhole CLI to v0.1.2 or later.",
  "id": "GHSA-fh2f-xfxc-q9cc",
  "modified": "2026-07-28T22:20:51Z",
  "published": "2026-07-28T22:20:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bablilayoub/openhole"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bablilayoub/openhole/releases/tag/v0.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "openhole-server vulnerable to path traversal via URL-decoded request path"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54650 (GCVE-0-2026-54650)

FKIE_CVE-2026-54650

GHSA-FH2F-XFXC-Q9CC

Summary

Impact

Fix

Tags

Sightings

Nomenclature

Related by attack behaviour