{"action":"Upgrade github.com/bablilayoub/openhole to 0.1.2 or later.","affected":[{"fixed":"0.1.2","introduced":"0"}],"component":"github.com/bablilayoub/openhole","cve_ids":["CVE-2026-54650"],"ecosystem":"Go","epss":0.0053,"exploited":false,"fixed_versions":["0.1.2"],"ghsa_id":"GHSA-fh2f-xfxc-q9cc","id":"tcs_01M5KGS2MAW0SC1K0YSVXJ795N","modified_at":"2026-08-18T15:00:21.351134955Z","published_at":"2026-08-18T14:32:29Z","references":["https://osv.dev/vulnerability/GO-2026-6135","https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc","https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3","https://github.com/bablilayoub/openhole/releases/tag/v0.1.2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6135","url":"https://osv.dev/vulnerability/GO-2026-6135"}],"summary":"openhole-server vulnerable to path traversal via URL-decoded request path in github.com/bablilayoub/openhole"}