All vulnerabilities
CVE-2023-6569GHSA-gqrq-j6pm-98c2PYSEC-2026-350

External Control of File Name or Path in h2oai/h2o-3

h2oai h2opipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 22 May 2025. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.72%Chance of exploitation activity in the next 30 days, higher than 53% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in3.46.0.1Fixed versionGitHub
Published14 Dec 2023Updated 27 Oct 2026CVE List

What fixes it

  • 3.46.0.1h2o, pipGitHub
  • 3.46.0.1h2o, PyPIOSVpip install "h2o>=3.46.0.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting as CSV.

Text from CVE List

Affected versions 53

  • h2o, pip< 3.46.0.1GitHub
  • h2oai/h2o-3affected: unspecified through latestCVE List
  • h2o, PyPIfrom first release, fixed in 3.46.0.1OSV
  • h2o, PyPI3.10.0.10OSV
  • h2o, PyPI3.10.0.3OSV
  • h2o, PyPI3.10.0.6OSV
  • h2o, PyPI3.10.0.7OSV
  • h2o, PyPI3.10.0.8OSV
  • h2o, PyPI3.10.3.3OSV
  • h2o, PyPI3.10.3.4OSV
  • h2o, PyPI3.10.4.1OSV
  • h2o, PyPI3.10.4.2OSV
  • h2o, PyPI3.10.4.3OSV
  • h2o, PyPI3.10.4.4OSV
  • h2o, PyPI3.10.4.6OSV
  • h2o, PyPI3.10.4.8OSV
  • h2o, PyPI3.16.0.1OSV
  • h2o, PyPI3.16.0.2OSV
  • h2o, PyPI3.16.0.3OSV
  • h2o, PyPI3.16.0.4OSV
  • h2o, PyPI3.18.0.1OSV
  • h2o, PyPI3.18.0.10OSV
  • h2o, PyPI3.18.0.11OSV
  • h2o, PyPI3.18.0.2OSV
  • h2o, PyPI3.18.0.3OSV
  • h2o, PyPI3.18.0.4OSV
  • h2o, PyPI3.18.0.5OSV
  • h2o, PyPI3.18.0.6OSV
  • h2o, PyPI3.18.0.7OSV
  • h2o, PyPI3.18.0.8OSV
  • h2o, PyPI3.18.0.9OSV
  • h2o, PyPI3.20.0.4OSV
  • h2o, PyPI3.20.0.5OSV
  • h2o, PyPI3.20.0.6OSV
  • h2o, PyPI3.20.0.7OSV
  • h2o, PyPI3.20.0.8OSV
  • h2o, PyPI3.22.0.1OSV
  • h2o, PyPI3.22.0.2OSV
  • h2o, PyPI3.22.0.3OSV
  • h2o, PyPI3.22.0.4OSV
  • h2o, PyPI3.22.0.5OSV
  • h2o, PyPI3.22.1.1OSV
  • h2o, PyPI3.22.1.2OSV
  • h2o, PyPI3.22.1.3OSV
  • h2o, PyPI3.22.1.4OSV
  • h2o, PyPI3.22.1.5OSV
  • h2o, PyPI3.22.1.6OSV
  • h2o, PyPI3.24.0.1OSV
  • h2o, PyPI3.24.0.2OSV
  • h2o, PyPI3.24.0.3OSV
  • h2o, PyPI3.24.0.4OSV
  • h2o, PyPI3.24.0.5OSV
  • h2o, PyPI3.26.0.1OSV

References 6