DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54650: CVE-2026-54650: Remote Path Traversal in openhole-server and openhole CLI Client

#security #cve #cybersecurity

CVE-2026-54650: Remote Path Traversal in openhole-server and openhole CLI Client

Vulnerability ID: CVE-2026-54650
CVSS Score: 8.6
Published: 2026-07-28

A critical path traversal vulnerability (CWE-22) in openhole-server version 0.1.1 and earlier allows remote, unauthenticated attackers to traverse directories and access restricted files or endpoints on local backend services exposed via the tunnel proxy. The issue stems from improper handling of decoded URL paths inside the proxy handler, which are then reconstructed and executed literally by the CLI client.

TL;DR

A path traversal flaw in the openhole proxy server decodes percent-encoded dot-dot-slash segments and forwards them to the local agent, which executes raw, unauthorized file retrieval requests against local development services.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network
  • CVSS v3.1: 8.6
  • EPSS Score: N/A
  • Impact: Confidentiality (High)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • openhole-server <= 0.1.1
  • openhole CLI client <= 0.1.1
  • openhole: <= 0.1.1 (Fixed in: 0.1.2)

Code Analysis

Commit: a28c27a

Fix path traversal by preserving escaped URL path in server and parsing properly in client proxy

Exploit Details

  • GitHub: Verification tests and proof-of-concept components in test suites

Mitigation Strategies

  • Upgrade openhole binaries and server components to version 0.1.2 or above
  • Restrict access to the public proxy using firewall rules, IP whitelisting, or authentication headers
  • Avoid running local development servers under privileged administrator accounts

Remediation Steps:

  1. Run the default installation update script: curl -fsSL https://openhole.dev/install.sh | sh
  2. Alternatively, pull from source, checkout v0.1.2, and compile using: go build -o openhole cmd/openhole/main.go
  3. Restart any active tunnels to ensure updated path routing configurations are enforced

References

Read the full report for CVE-2026-54650 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)