H2O · H2O · CVE-2015-5638
**Name of the Vulnerable Software and Affected Versions**
H2O versions prior to 1.4.5
H2O versions 1.5.x prior to 1.5.0-beta2
**Description**
A directory traversal issue allows remote attackers to read arbitrary files via a crafted URL when the file.dir directive is enabled.
**Recommendations**
For H2O versions prior to 1.4.5, update to version 1.4.5 or later.
For H2O versions 1.5.x prior to 1.5.0-beta2, update to version 1.5.0-beta2 or later.