GHSA-wj3h-wx8g-x699
Critical · 9.1CVSS
9.1
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
H2O has an External Control of File Name or Path vulnerability
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | ai.h2o:h2o-core | 0 | No fix |
| PyPI | h2o | 0 | No fix |
Related vulnerabilities
- CVE-2024-5986 A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write… Same vulnerability
- CVE-2026-88899 knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request… CWE-73
- CVE-2026-53956 Rattler is a library that provides common functionality used within the conda ecosystem. CWE-73
- CVE-2026-79692 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-73
- CVE-2026-86995 n8n is an open source workflow automation platform. CWE-73
- CVE-2026-62804 External control of file name or path in Microsoft Office Word allows an unauthorized… CWE-73
- CVE-2026-81830 The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local… CWE-73
- CVE-2026-79426 An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component… CWE-73