---
id: CVE-2024-6854
aliases:
  - GHSA-47f6-5p7h-5f3h
  - PYSEC-2026-1436
title: H2O Vulnerable to Arbitrary File Overwrite via File Export
summary: H2O Vulnerable to Arbitrary File Overwrite via File Export
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'
vendor: h2o
product: h2o
ecosystem: pip
affected:
  - 'h2o >= 3.32.1.1, <= 3.46.0'
  - 'ai.h2o:h2o-core >= 3.32.1.1, <= 3.46.0'
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-47f6-5p7h-5f3h'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-6854'
  - url: 'https://github.com/h2oai/h2o-3'
  - url: >-
      https://github.com/h2oai/h2o-3/blob/a20b5b19b769866ee24b217ee78b820e64c1cd6a/h2o-core/src/main/java/hex/Model.java#L3366
  - url: 'https://huntr.com/bounties/97d013f9-ac51-4c80-8dd7-8dfde11f33b2'
tags:
  - osv
  - pip
epss: 0.0076
epssPercentile: 0.53319
ingestedAt: '2026-07-08T18:25:45.277Z'
---

## Overview

In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.

## Affected packages

- `h2o >= 3.32.1.1, <= 3.46.0`
- `ai.h2o:h2o-core >= 3.32.1.1, <= 3.46.0`

## Remediation

Refer to the advisory for the patched release.