High severity · published Nov 16, 2023
CVE-2023-6038
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of…
7.5
CVSS
4.3%
EPSS
No
On KEV
Description
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H2
H2o · H2o
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6038
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6038
Exploit
https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c
More from H2o
9.8
CVE-2026-8751
h2oai h2o-3 JAR Model.java importBinaryModel deserialization
9.8
CVE-2026-3960
Remote Code Execution in h2oai/h2o-3
9.8
CVE-2025-10769
h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization
9.8
CVE-2025-10768
h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
9.8
CVE-2025-6544
Deserialization Vulnerability in h2oai/h2o-3