{"id":"CVE-2023-6569","kind":"vulnerability","aliases":["CVE-2023-6569","GHSA-gqrq-j6pm-98c2"],"related":[],"title":"External Control of File Name or Path in h2oai/h2o-3","description":"Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with \"C1\", if they're exporting as CSV.","summary":"H2O-3 writes exported data to disk using a path an attacker can influence, so a remote unauthenticated request can overwrite arbitrary files on the server. The written content is partly controllable, which is enough to damage files or plant payloads that other processes read.","severity":"critical","cvss":9.3,"epss":0.00721,"exploited":false,"exploited_at":null,"products":[{"name":"h2o","fixed":["3.46.0.1"],"affected":"< 3.46.0.1","ecosystem":"pypi"},{"name":"h2o","fixed":[],"affected":"= 3.40.0.4","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-610","cwe-73","data-science","h2o","package","python","self-hosted"],"not_affected_if":["fixed-version","local-only-use"],"how_to_check":"- Run `pip show h2o` and confirm the installed version is below `3.46.0.1`.\n- Check whether the H2O server's REST port is reachable from untrusted networks.","fix":"- Upgrade the `h2o` Python package to `3.46.0.1` or later.\n- Restrict network access to the H2O API port until the upgrade is applied.","status":"open","published_at":"2023-12-14T13:15:55+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","triaged_at":"2026-10-27T16:38:03+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T16:38:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `h2o` Python package to `3.46.0.1` or later.\n- Restrict network access to the H2O API port until the upgrade is applied.","reach":"internet","title":"H2O-3: unauthenticated file export lets attackers overwrite arbitrary server files","impact":"high","summary":"H2O-3 writes exported data to disk using a path an attacker can influence, so a remote unauthenticated request can overwrite arbitrary files on the server. The written content is partly controllable, which is enough to damage files or plant payloads that other processes read.","category":"package","nicknames":[],"who_cares":["python","h2o","self-hosted","data-science"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker overwrites arbitrary server files with partly controlled content.","analyst_note":"","how_to_check":"- Run `pip show h2o` and confirm the installed version is below `3.46.0.1`.\n- Check whether the H2O server's REST port is reachable from untrusted networks.","needs_analyst":false,"not_affected_if":["fixed-version","local-only-use"],"who_is_affected":"Teams that run an H2O-3 server (the h2o Python package starts one) with its API reachable over the network are exposed. Local-only notebook use on a machine without a reachable port is much lower risk, and teams already on 3.46.0.1 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000597,"input_tokens":3377,"output_tokens":519,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2023':11A,19A '-3':37B '-610':24B '-6569':12A,20A '-73':26B '98c2':17A 'arbitrari':57B,86C,104C 'attack':47B,83C,91C,98C,114C 'attacker-control':90C 'c1':123C 'content':64B 'control':2A,67B,92C,100C 'csv':129C 'csv/xls/etc':108C 'cve':10A,18A 'cwe':23B,25B 'damag':72B 'data':28B,40B,93C,95C,115C 'data-sci':27B 'disk':42B,111C 'enough':70B 'entir':103C 'export':39B,127C 'extern':1A 'file':4A,58B,73B,88C,109C 'ghsa':14A 'ghsa-gqrq-j6pm-98c2':13A 'gqrq':15A 'h2o':21A,22A,30B,36B,105C 'h2oai/h2o-3':9A 'host':35B 'influenc':49B 'j6pm':16A 'name':5A 'overwrit':56B,85C 'packag':31B 'part':66B 'path':7A,45B 'payload':76B 'plant':75B 'process':79B 'python':32B 'quotat':119C 're':126C 'read':80B 'remot':52B,81C 'request':54B 'scienc':29B 'self':34B 'self-host':33B 'server':61B,87C 'start':121C 'unauthent':53B,82C 'use':43B 'wrap':117C 'write':38B,106C 'written':63B","nicknames":[],"mitigations":[],"who_affected":"Teams that run an H2O-3 server (the h2o Python package starts one) with its API reachable over the network are exposed. Local-only notebook use on a machine without a reachable port is much lower risk, and teams already on 3.46.0.1 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2023-12-14T13:15:55+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gqrq-j6pm-98c2","url":"https://github.com/advisories/GHSA-gqrq-j6pm-98c2","severity":"critical","published_at":"2023-12-14T15:30:22+00:00","modified_at":"2026-10-27T16:32:56+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","fetched_at":"2026-10-27T16:35:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-6569","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6569","severity":null,"published_at":"2023-12-14T13:15:55+00:00","modified_at":"2026-06-17T06:51:00+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}