@openhop/server: Path Traversal in Flow ID File Operations

Published September 9, 2026 CVE-2026-59179

@openhop/server can let an unauthenticated remote user read reachable YAML files outside its flow folder or delete them. This can expose configuration data or cause file loss.

Severity
HighCVSS 8.3
Fix
Fixed in 0.3.6Fix recorded yesterday
Affected versions
0.3.5 or older
Affects
@openhop/server

How it works

  • The server uses a flow ID from an HTTP request to create a YAML file path.
  • Special path elements can move that path outside the configured flow folder.
  • The read and delete operations require no login.
  • Network access can expose server deployments, while a malicious webpage can target a locally running instance.

What to do

Run npm ls --all @openhop/server in each application environment and compare the installed version with 0.3.6. Versions 0.3.5 and earlier are affected; checking one environment does not check other deployments.

Run this in the application environment you want to check:

npm ls --all @openhop/server

Update @openhop/server to 0.3.6 using the application's normal package update process. Later versions require verification against the advisory, which identifies 0.3.6 as the patched version.

Technical details

CVE-2026-59179 affects @openhop/server's flow file operations. Unsanitized route values can escape the configured directory and reach accessible YAML files, allowing unauthorized reads or permanent deletion. The advisory rates it High with a CVSS 3.1 score of 8.3.

References

View Original Source