CVE-2026-54650 Details
Description
openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.
A path traversal vulnerability has been identified in Openhole Server versions through 0.1.1. The issue arises because the server improperly forwards the URL-decoded request path to tunneled local services, allowing percent-encoded dot segments and separators to bypass normal path handling and access files outside the intended directory. This vulnerability could be exploited to read sensitive files, such as '/etc/passwd', from the local system via the tunneled connection.
Users should upgrade to Openhole Server version 0.1.2 or later, which addresses the vulnerability by properly handling the request path and preserving the original request target.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3 | [email protected] | Source CodeVendor |
| https://github.com/bablilayoub/openhole/releases/tag/v0.1.2 | [email protected] | Release NotesVendor |
| https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bablilayoub openhole | <= 0.1.1 (semver) |
CPE
Remediation
| |
| bablilayoub openhole-server | <= 0.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |