# CVE-2026-8750: h2oai h2o-3 path traversal in ImportFiles API

Source: https://junglewise.ai/threats/cve-2026-8750-h2oai-h2o-3-path-traversal-in-importfiles-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2026-8750 · Severity: medium · CVSS 5.3 · Published 2026-05-17

h2o-3 is an open-source machine learning platform used for data analysis and model building. A security vulnerability in its file import feature allows unauthorized individuals to remotely access and read sensitive files from the server's local storage. This could lead to the exposure of configuration files, system metadata, or other private data, potentially compromising the security of the entire host system.

Technologies: [H2O.ai H2O-3](https://junglewise.ai/threats/technologies/h2o-3). Vendors: [H2O.ai](https://junglewise.ai/threats/vendors/h2o-ai).

## Quick answers

**Is CVE-2026-8750 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8750 being exploited in the wild.

**How severe is CVE-2026-8750?** Medium severity, with a CVSS score of 5.3, published 17 May 2026.

**Which products and versions are affected?** H2O.ai H2O-3 up to 7402.

**Is there a fix for CVE-2026-8750?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8750 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8750?** Check whether you run H2O.ai H2O-3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the `importFiles` function within `h2o-core/src/main/java/water/persist/PersistNFS.java`. The `POST /3/ImportFiles` endpoint is exposed without authentication and accepts attacker-controlled filesystem paths. While the application implements a 'deny-glob' blacklist (blocking directories like /etc and /proc), it fails to restrict access to other sensitive local paths. An unauthenticated attacker can use this endpoint to import a local file as an H2O frame and subsequently retrieve the file's contents via the `GET /3/Frames/` API. The vulnerability stems from trusting user-supplied absolute paths and relying on an incomplete blacklist-based security model.

## Affected products

- h2oai h2o-3 up to 7402

## Timeline

- 2026-05-17: advisory: Vulnerability published by NVD/VulDB

## References

- [https://vuldb.com/submit/810105](https://vuldb.com/submit/810105)
- [https://vuldb.com/vuln/364377](https://vuldb.com/vuln/364377)
- [https://vuldb.com/vuln/364377/cti](https://vuldb.com/vuln/364377/cti)
- [https://vulnplus-note.wetolink.com/share/wWjmsfKHRJi3](https://vulnplus-note.wetolink.com/share/wWjmsfKHRJi3)

## Related threats

- [H2Oai H2O-3 improper access control in Rapids setproperty](https://junglewise.ai/threats/cve-2026-8752-h2oai-h2o-3-improper-access-control-in-rapids-setproperty)
- [h2oai h2o-3 insecure deserialization in importBinaryModel](https://junglewise.ai/threats/cve-2026-8751-h2oai-h2o-3-insecure-deserialization-in-importbinarymodel)
- [H2O.ai H2O-3 remote code execution in ImportSQLTable API](https://junglewise.ai/threats/cve-2026-3960-h2o-ai-h2o-3-remote-code-execution-in-importsqltable-api)
- [h2oai h2o-3 arbitrary file overwrite via path traversal](https://junglewise.ai/threats/cve-2023-6569-h2oai-h2o-3-arbitrary-file-overwrite-via-path-traversal)