{"action":"Upgrade h2o to 3.46.0.1 or later.","affected":[{"fixed":"3.46.0.1","introduced":"0"}],"component":"h2o","cve_ids":["CVE-2023-6569"],"ecosystem":"PyPI","epss":0.00721,"exploited":false,"fixed_versions":["3.46.0.1"],"ghsa_id":"GHSA-gqrq-j6pm-98c2","id":"tcs_01M5KFJ4H12MKHTQ7HCF7130ME","modified_at":"2026-06-29T12:26:08.610757563Z","published_at":"2023-12-14T15:30:22Z","references":["https://osv.dev/vulnerability/GHSA-gqrq-j6pm-98c2","https://nvd.nist.gov/vuln/detail/CVE-2023-6569","https://github.com/h2oai/h2o-3/commit/e8884f5187eb81311877c5f0dd4d6d9c70f33d78","https://github.com/h2oai/h2o-3","https://huntr.com/bounties/a5d003dc-c23e-4c98-8dcf-35ba9252fa3c"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-gqrq-j6pm-98c2","url":"https://osv.dev/vulnerability/GHSA-gqrq-j6pm-98c2"}],"summary":"External Control of File Name or Path in h2oai/h2o-3"}