Sign in
Deutsch English Español Polski
Medium

Arbitrary system path lookup in h20

  • Disclosed: 06.06.2024
  • Updated: 11.10.2026 13:18

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) h2o <= 3.40.0.4 no fix

References

CVSS score 5.3/10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-200, CWE-22
Platform
Python (PyPI)
Package
h2o
Disclosed
06.06.2024
Updated
11.10.2026 13:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-1446 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-x234-r5fg-x52m - CC BY 4.0

Vulnerability history: h2o

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (17) in the archive
Total entries
17
First → latest
12.2023 04.2026
Without a fix
14
Exploited in attacks
0

Severity breakdown

  • Critical 6
  • High 9
  • Medium 2

Disclosures per year

Severity:
  1. A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
    Critical · 9.8 CVE-2026-3960 < 3.46.0.10 3.46.0.10
  2. H2O has an External Control of File Name or Path vulnerability
    Critical · 9.1 CVE-2024-5986 <= 3.46.0.1 no fix
  3. H2O affected by a deserialization vulnerability
    Critical · 9.8 CVE-2025-6544 <= 3.46.0.7 no fix
  4. H2O Vulnerable to Arbitrary File Overwrite
    High · 8.2 CVE-2024-8616 >= 3.10.4.1, <= 3.46.0 no fix
  5. H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request
    High · 7.5 CVE-2024-8062 >= 3.2.0.1, <= 3.46.0 no fix
  6. H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
    High · 7.5 CVE-2024-7768 <= 3.46.1 no fix
  7. H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing
    High · 7.5 CVE-2024-7765 >= 3.32.1.2, <= 3.46.0.2 no fix
  8. H2O Vulnerable to Arbitrary File Overwrite via File Export
    High · 7.1 CVE-2024-6854 >= 3.32.1.1, <= 3.46.0 no fix
  9. H2O Vulnerable to Denial of Service (DoS) and File Write
    High · 7.5 CVE-2024-10572 >= 3.34.0.1, <= 3.46.0.1 no fix
  10. H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint
    High · 7.5 CVE-2024-10550 >= 3.30.0.7, <= 3.46.0.1 no fix
  11. H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint
    High · 7.5 CVE-2024-10549 >= 3.30.0.7, <= 3.46.0.1 no fix
  12. H2O Deserialization of Untrusted Data Vulnerability
    Critical · 9.8 CVE-2024-10553 < 3.46.0.6 3.46.0.6
  13. H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
    Critical · 9.1 CVE-2024-45758 <= 3.46.0.7 no fix
  14. h2o vulnerable to unexpected POST request shutting down server
    High · 7.5 CVE-2024-5979 <= 3.46.0 no fix
  15. Arbitrary system path lookup in h20 this entry
    Medium · 5.3 CVE-2024-5550 <= 3.40.0.4 no fix
  16. External Control of File Name or Path in h2oai/h2o-3
    Critical · 9.3 CVE-2023-6569 < 3.46.0.1 3.46.0.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.