High severity · published Nov 16, 2023
CVE-2023-6038
Local File Inclusion in h2oai/h2o-3
7.5
CVSS
4.3%
EPSS
No
On KEV
Description
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H2
h2oai/h2o-3 · h2oai
through latest · source: vendor
H2
H2o · H2o
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6038
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6038
Exploit
https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c
More from h2oai/h2o-3
9.8
CVE-2026-3960
Remote Code Execution in h2oai/h2o-3
9.8
CVE-2025-6544
Deserialization Vulnerability in h2oai/h2o-3
9.8
CVE-2025-5662
Deserialization Vulnerability in h2oai/h2o-3
9.8
CVE-2025-6507
Deserialization of Untrusted Data in h2oai/h2o-3
9.8
CVE-2024-10553
Jdbc Deserialization in h2oai/h2o-3