---
id: CVE-2024-8616
aliases:
  - GHSA-g48v-3p35-88jr
  - PYSEC-2026-1441
title: H2O Vulnerable to Arbitrary File Overwrite
summary: H2O Vulnerable to Arbitrary File Overwrite
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
vendor: h2o
product: h2o
ecosystem: pip
affected:
  - 'h2o >= 3.10.4.1, <= 3.46.0'
  - 'ai.h2o:h2o-core >= 3.10.4.1, <= 3.46.0'
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g48v-3p35-88jr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8616'
  - url: 'https://github.com/h2oai/h2o-3'
  - url: >-
      https://github.com/h2oai/h2o-3/blob/088190f9d0370a02a483fca68d8dc89c996b4f83/h2o-core/src/main/java/water/api/ModelsHandler.java#L310
  - url: 'https://huntr.com/bounties/aebf69a5-b9b1-4d2f-a8ff-902c11a8c97a'
tags:
  - osv
  - pip
epss: 0.00546
epssPercentile: 0.44698
ingestedAt: '2026-07-08T18:25:49.213Z'
---

## Overview

In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.

## Affected packages

- `h2o >= 3.10.4.1, <= 3.46.0`
- `ai.h2o:h2o-core >= 3.10.4.1, <= 3.46.0`

## Remediation

Refer to the advisory for the patched release.