{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"3.32.1.1","last_affected":"3.46.0"}],"component":"h2o","cve_ids":["CVE-2024-6854"],"ecosystem":"PyPI","epss":0.00776,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-47f6-5p7h-5f3h","id":"tcs_01M5KGSKBQCRVCH46M9GBFH0YA","modified_at":"2026-07-07T17:47:39.215166447Z","published_at":"2026-07-07T14:34:54.751354Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1436","https://nvd.nist.gov/vuln/detail/CVE-2024-6854","https://github.com/h2oai/h2o-3","https://github.com/h2oai/h2o-3/blob/a20b5b19b769866ee24b217ee78b820e64c1cd6a/h2o-core/src/main/java/hex/Model.java#L3366","https://huntr.com/bounties/97d013f9-ac51-4c80-8dd7-8dfde11f33b2","https://pypi.org/project/h2o","https://github.com/advisories/GHSA-47f6-5p7h-5f3h"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-1436","url":"https://osv.dev/vulnerability/PYSEC-2026-1436"}],"summary":"H2O Vulnerable to Arbitrary File Overwrite via File Export"}