CVE-2023-6569: External Control of File Name or Path in h2oai/h2o-3
Vulnerability summary
CVE-2023-6569 is a critical (CVSS 9.3) External Control of File Name or Path vulnerability in h2o. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 54% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 14-12-2023PublishedVulnerability first disclosed.
- 22-05-2025Last modifiedVulnerability information updated.
Description
External Control of File Name or Path in h2oai/h2o-3
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · PypiEcosystem advisory · calculated9.3CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
- NVDNIST9.3CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.72% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
H2o1 product
- h2o3.40.0.4
H2oai1 product
- h2oai/h2o-3≥ unspecified, ≤ latest
PyPI1 product
- h2o< 3.46.0.1
3 vendors · 3 products
References
7 links
- github.com/h2oai/h2o-3PACKAGE