{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"3.32.1.1","last_affected":"3.46.0"}],"component":"h2o","cve_ids":["CVE-2024-6854"],"ecosystem":"PyPI","epss":0.00776,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-47f6-5p7h-5f3h","id":"tcs_01M5KEXFFS80XATEHBPHJJB5WP","modified_at":"2026-07-07T17:57:08.535500605Z","published_at":"2025-03-20T12:32:45Z","references":["https://osv.dev/vulnerability/GHSA-47f6-5p7h-5f3h","https://nvd.nist.gov/vuln/detail/CVE-2024-6854","https://github.com/h2oai/h2o-3","https://github.com/h2oai/h2o-3/blob/a20b5b19b769866ee24b217ee78b820e64c1cd6a/h2o-core/src/main/java/hex/Model.java#L3366","https://huntr.com/bounties/97d013f9-ac51-4c80-8dd7-8dfde11f33b2"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-47f6-5p7h-5f3h","url":"https://osv.dev/vulnerability/GHSA-47f6-5p7h-5f3h"}],"summary":"H2O Vulnerable to Arbitrary File Overwrite via File Export"}