OpenHop Server: Path traversal in flow ID file operations
Summary
OpenHop, a tool for creating interactive data-flow diagrams, does not validate flow IDs in its server routes before building file paths. An unauthenticated attacker can read YAML files outside the flow directory or delete them, which may expose configuration or secrets and disrupt dependent services. The CORS policy also allowed any browser origin, so a malicious web page could reach a loopback-bound instance; Docker deployments that default to binding on all interfaces are directly reachable from the network.
Affected
- @openhop/server (OpenHop) versions before 0.3.7 (CVE record)
- Advisory mirrors list the npm package as affected below 0.3.6; the exact fixed version is not verified
Fixed in
- Upgrade to 0.3.7 or later (fix commit c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4, PR #190)
Workaround
- Do not expose the service on 0.0.0.0; keep it on loopback or behind a firewall
- Avoid the default HOST=0.0.0.0 in Docker unless an authenticating reverse proxy is in front
- Back up flow YAML files until the update is applied
Exploitation
- CISA SSVC: exploitation status 'poc' (public proof of concept exists)
- CISA SSVC: not automatable; technical impact partial
- EPSS 0.39 %
- No report of exploitation in the wild found (not checked against the CISA KEV catalogue)
Our recommendation
- Update @openhop/server to 0.3.7 or later
- Check lockfiles and deployed manifests for @openhop/server
- Do not expose the server to untrusted networks; restrict Docker port bindings
- Back up flow YAML files and monitor for unexpected changes or deletions
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-g72f-jw3w-mgh7 github.com
- Fix commit c8190fb github.com
- Pull Request #190 github.com
- Release v0.3.7 github.com
- GitLab Advisory Database (npm @openhop/server) advisories.gitlab.com
- OSV GHSA-g72f-jw3w-mgh7 osv.dev
- Tenable plugin 447875 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:07.
Original description (NVD)
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7.
NVD references (5)
- https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4
- https://github.com/naorsabag/openhop/pull/190
- https://github.com/naorsabag/openhop/releases/tag/v0.3.7
- https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7
- https://github.com/naorsabag/openhop/security/advisories/GHSA-g72f-jw3w-mgh7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.