Skip to content
Threat Feed
Subscribe

Product

Openhole-Server (<= 0.1.1)

1 brief RSS
high advisory

Path Traversal Vulnerability in openhole-server (CVE-2026-54650)

An unauthenticated path traversal vulnerability (CVE-2026-54650) in openhole-server and openhole CLI versions 0.1.1 and earlier allows remote attackers to read arbitrary files outside the web root on tunneled local services by exploiting URL-decoded percent-encoded dot-segments and slashes, enabling arbitrary file disclosure and potential bypass of access controls.

openhole-server +1 vulnerability path-traversal webserver
1r 2t