# CVE-2026-59179 - OpenHop: Path Traversal in Flow ID File Operations

DevFeed: [CVE-2026-59179 - OpenHop: Path Traversal in Flow ID File Operations](<https://devfeed.tech/articles/cve-2026-59179-openhop-path-traversal-in-flow-id-file-operations-104698.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-59179>)

Author: CVEFEED.io; github.com

Published: 2026-10-28T14:17:04Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Authorization](<https://devfeed.tech/topics/authorization.md>), [Cross-origin resource sharing (CORS)](<https://devfeed.tech/topics/cors.md>), [CRUD](<https://devfeed.tech/topics/crud.md>)

Tags: [accessible](<https://devfeed.tech/tags/accessible.md>), [api](<https://devfeed.tech/tags/api.md>), [browser](<https://devfeed.tech/tags/browser.md>), [can](<https://devfeed.tech/tags/can.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [cors](<https://devfeed.tech/tags/cors.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-59179](<https://devfeed.tech/tags/cve-2026-59179.md>), [cvss](<https://devfeed.tech/tags/cvss.md>), [data](<https://devfeed.tech/tags/data.md>), [delete](<https://devfeed.tech/tags/delete.md>), [deployments](<https://devfeed.tech/tags/deployments.md>), [details](<https://devfeed.tech/tags/details.md>), [directory](<https://devfeed.tech/tags/directory.md>), [file](<https://devfeed.tech/tags/file.md>), [flow](<https://devfeed.tech/tags/flow.md>), [id](<https://devfeed.tech/tags/id.md>), [operations](<https://devfeed.tech/tags/operations.md>), [path-traversal](<https://devfeed.tech/tags/path-traversal.md>), [traversal](<https://devfeed.tech/tags/traversal.md>)

## AI overview

Before OpenHop 0.3.7, unauthenticated `GET /api/flows/:id` and `DELETE /api/flows/:id` requests pass decoded flow IDs to file-path construction without an allow-list. Path normalization can reach `.yaml` files outside the configured flow directory, allowing accessible files to be read as YAML-parsed JSON or permanently deleted. The description says permissive CORS can expose loopback-bound instances to malicious webpages, while Docker defaults to `HOST=0.0.0.0` and allows direct unauthenticated network access. The issue is fixed in repository release 0.3.7; the supplied text does not identify affected product versions.

## Source excerpt

CVE ID :CVE-2026-59179 Published : Oct. 28, 2026, 2:17 p.m. | 2 hours, 30 minutes ago Description :OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowStore.filePath()` in `packages/server/src/store.ts` without an identifier allow-list. The router applies `decodeURIComponent` to the id, and `path.join()` then normalizes traversal outside the configured flow directory after appending the .yaml extension. An attacker can read accessible YAML files as YAML-parsed JSON or permanently delete accessible .yaml files outside that directory, exposing configuration or secrets and disrupting dependent services. In `packages/server/src/index.ts`, CORS `origin: true` permits any browser origin, enabling a malicious webpage to target a loopback-bound instance. Docker deployments default to `HOST=0.0.0.0` and permit direct unauthenticated network access. This issue is fixed in repository release 0.3.7. Severity: 8.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...