https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T13:39:37.488455+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-6854 CVE-2024-6854 — Arbitrary File Overwrite in h2oai/h2o-3 2026-10-09T13:39:37.491480+00:00

Affected: h2oai/h2o-3

In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.

 https://cve.radiocsirt.org/vuln/ghsa-47f6-5p7h-5f3h GHSA-47f6-5p7h-5f3h — H2O Vulnerable to Arbitrary File Overwrite via File Export 2026-10-09T13:39:37.491541+00:00

Affected: PyPI: h2o, Maven: ai.h2o:h2o-core

In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.