{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/openhole-cli--0.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["openhole-server (\u003c= 0.1.1)","openhole CLI (\u003c= 0.1.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","path-traversal","webserver"],"_cs_type":"advisory","_cs_vendors":["bablilayoub"],"content_html":"\u003cp\u003eA high-severity path traversal vulnerability, tracked as CVE-2026-54650, affects \u003ccode\u003eopenhole-server\u003c/code\u003e and the \u003ccode\u003eopenhole CLI\u003c/code\u003e in versions 0.1.1 and earlier. Discovered by GHSA, this flaw allows an unauthenticated remote attacker to access arbitrary files outside the intended web root on local services exposed through the \u003ccode\u003eopenhole\u003c/code\u003e tunnel. The vulnerability stems from the server incorrectly forwarding the URL-decoded request path (\u003ccode\u003er.URL.Path\u003c/code\u003e) to tunnel clients instead of preserving the original, percent-encoded request-target. This leads to percent-encoded dot-segments (\u003ccode\u003e%2e%2e/\u003c/code\u003e for \u003ccode\u003e../\u003c/code\u003e) and separators (\u003ccode\u003e%2f\u003c/code\u003e for \u003ccode\u003e/\u003c/code\u003e) being decoded and interpreted literally by the backend, bypassing Go's \u003ccode\u003eServeMux\u003c/code\u003e protections against literal path traversals. This could enable attackers to read sensitive configuration files, system files like \u003ccode\u003e/etc/passwd\u003c/code\u003e, and potentially bypass existing path-based access controls.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated remote attacker crafts a malicious HTTP request targeting an \u003ccode\u003eopenhole-server\u003c/code\u003e instance.\u003c/li\u003e\n\u003cli\u003eThe request path includes specifically engineered URL-encoded directory traversal sequences, such as \u003ccode\u003e/%2e%2e/\u003c/code\u003e (for \u003ccode\u003e../\u003c/code\u003e) and potentially \u003ccode\u003e%2f\u003c/code\u003e (for \u003ccode\u003e/\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eopenhole-server\u003c/code\u003e receives this request and, due to the vulnerability, URL-decodes the \u003ccode\u003er.URL.Path\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe percent-encoded traversal sequences are transformed into their literal forms (e.g., \u003ccode\u003e%2e%2e\u003c/code\u003e becomes \u003ccode\u003e..\u003c/code\u003e and \u003ccode\u003e%2f\u003c/code\u003e becomes \u003ccode\u003e/\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server then forwards this URL-decoded path to the tunneled backend service, effectively bypassing Go's \u003ccode\u003eServeMux\u003c/code\u003e protection that typically rejects literal \u003ccode\u003e../\u003c/code\u003e sequences.\u003c/li\u003e\n\u003cli\u003eThe backend service processes the path, interpreting the literal \u003ccode\u003e../\u003c/code\u003e sequences as directory traversals, allowing access to files outside its intended web root or application directory.\u003c/li\u003e\n\u003cli\u003eThe attacker gains unauthorized access to and reads sensitive files (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e, application configuration files) from the victim's system, which are then returned in the HTTP response.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-54650 can lead to severe consequences for organizations utilizing vulnerable versions of \u003ccode\u003eopenhole-server\u003c/code\u003e. An unauthenticated remote attacker can read arbitrary files from the underlying system that hosts the tunneled service, beyond the intended web or application root. This can expose sensitive information such as user credentials, system configuration, source code, and other proprietary data. The vulnerability also allows for the bypass of path-based access controls, potentially granting access to restricted areas or functionalities. While specific victim counts or targeted sectors are not detailed, any organization using affected \u003ccode\u003eopenhole-server\u003c/code\u003e instances is at risk of significant data breaches and unauthorized system access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade \u003ccode\u003eopenhole-server\u003c/code\u003e and \u003ccode\u003eopenhole CLI\u003c/code\u003e to version \u003ccode\u003ev0.1.2\u003c/code\u003e or later to remediate CVE-2026-54650.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect CVE-2026-54650 Exploitation Attempt in openhole-server\u0026quot; to your SIEM to identify HTTP requests containing suspicious URL-encoded path traversal sequences.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive webserver logging to capture full HTTP request paths and query parameters for detection and forensic analysis.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T22:24:50Z","date_published":"2026-07-28T22:24:50Z","id":"https://feed.craftedsignal.io/briefs/2026-07-openhole-server-path-traversal/","summary":"An unauthenticated path traversal vulnerability (CVE-2026-54650) in openhole-server and openhole CLI versions 0.1.1 and earlier allows remote attackers to read arbitrary files outside the web root on tunneled local services by exploiting URL-decoded percent-encoded dot-segments and slashes, enabling arbitrary file disclosure and potential bypass of access controls.","title":"Path Traversal Vulnerability in openhole-server (CVE-2026-54650)","url":"https://feed.craftedsignal.io/briefs/2026-07-openhole-server-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Openhole CLI (\u003c= 0.1.1)","version":"https://jsonfeed.org/version/1.1"}