CVE-2026-59179

Name of the Vulnerable Software and Affected Versions OpenHop versions prior to 0.3.7

Description An unauthenticated path traversal issue exists in @openhop/server where unsanitized route parameters are passed to the FlowStore.filePath() function in packages/server/src/store.ts. The application uses path.join() to construct filesystem paths for flow YAML files, allowing an attacker to use traversal sequences to access files outside the configured flow directory. This affects the following endpoints:

An attacker can exploit this to read any .yaml file accessible to the process as YAML-parsed JSON or permanently delete any .yaml file reachable by the process, potentially exposing secrets or disrupting services. The risk is amplified because CORS is configured with origin: true, allowing malicious webpages to target local instances, and Docker deployments default to HOST=0.0.0.0, permitting direct network access. The vulnerable variable is id.

Recommendations Update to version 0.3.7. As a temporary mitigation, restrict network access to the server or implement a strict allow-list for the id parameter to prevent the use of traversal characters.