CVE-2026-54650: openhole-server vulnerable to path traversal via URL-decoded request path

July 28, 2026

openhole-server forwarded the URL-decoded request path (r.URL.Path) to tunnel clients instead of the original request-target. Percent-encoded dot-segments (%2e) and separators (%2f) were decoded to ../ and / before reaching the local service.

Go’s ServeMux rejects literal ../ paths, but percent-encoded traversal sequences bypassed this and were delivered to backends as working path traversal.

References

github.com/advisories/GHSA-fh2f-xfxc-q9cc
github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3
github.com/bablilayoub/openhole/releases/tag/v0.1.2
github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc
nvd.nist.gov/vuln/detail/CVE-2026-54650

Code Behaviors & Features

Detect and mitigate CVE-2026-54650 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →