HIGH 8.3 GitHub
CVE-2026-59179
@openhop/server: Path Traversal in Flow ID File Operations
## Path Traversal in Flow ID File Operations
### Summary
`@openhop/server` passes unsanitized HTTP route parameters directly to `path.join()` when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary `.yaml` files accessible to the OpenHop process outside the configured flow directory, and can delete arbitrary `.yaml` files at any path reachable by the process. Because CORS is set to `origin: true` (allow all origins), a vic
Affected Products
- npm/@openhop/server <= 0.3.5
References
- https://github.com/advisories/GHSA-g72f-jw3w-mgh7
- https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7
- https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4
- https://github.com/advisories/GHSA-g72f-jw3w-mgh7
This high severity vulnerability with a CVSS score of 8.3 was published on 2026-09-09 via GitHub. Affected: npm/@openhop/server <= 0.3.5.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.