Executive brief
OpenHop Server is a Node.js application used to manage workflow flows via a REST API. The application fails to validate flow identifiers before constructing filesystem paths, allowing unauthenticated attackers to read or delete YAML files anywhere the application process can access. This is particularly dangerous in Docker deployments (which bind to 0.0.0.0 by default) and local installations (which expose a permissive CORS policy allowing any website to make requests).
Technical details
The vulnerability is a classic path traversal (CWE-22) in the FlowStore.filePath() method (packages/server/src/store.ts:52–53), which concatenates an unsanitized user-supplied flow ID directly into path.join() without validation. The route parameter schema at packages/server/src/routes.ts declares only type: 'string' with no pattern or allowlist constraint. Fastify's underlying router (find-my-way) applies decodeURIComponent to route parameters, converting URL-encoded sequences like ..%2F to ../ before reaching application code. Node.js path.join() then normalizes paths, allowing attackers to escape the configured data directory (e.g., /data/flows) via traversal sequences. Two unauthenticated endpoints are affected: GET /api/flows/:id (reads files via readFile) and DELETE /api/flows/:id (deletes files via unlink). Additionally, CORS is configured with origin: true, enabling browser-based exploitation against loopback instances. Docker deployments default to HOST=0.0.0.0, making the server network-reachable. Patches are available in version 0.3.6 and later, introducing ID validation via regex (/^[A-Za-z0-9_-]+$/).
Affected products
- openhop @openhop/server <= 0.3.5
Timeline
- 2026-06-20: disclosed
- 2026-09-09: patched: Version 0.3.6 released with ID validation fix
- 2026-09-09: advisory