Path Traversal and Unauthenticated File Access in OpenHop Tool by Naor Sabag

CVE-2026-59179

What is CVE-2026-59179?

The OpenHop tool, utilized for creating interactive data-flow diagrams, has a security flaw that allows unauthenticated users to access and manipulate files. Prior to version 0.3.7, it processes GET /api/flows/:id and DELETE /api/flows/:id routes without proper validation or identification limits. This allows attackers to exploit the FlowStore.filePath() method to read or delete YAML files, potentially leaking sensitive configuration data or secrets. Furthermore, the default CORS settings and Docker deployment configurations expose the application to unauthorized network access. The vulnerability was addressed in version 0.3.7.

References