H2O.ai H2O-3 Model Export Overwrite Vulnerability

A vulnerability in H2O.ai H2O-3 version 3.46.0 allows unauthorized file overwriting on the server through the model export feature. The endpoint does not limit the export destination, enabling an attacker to replace any file in the server's file system with a trained model file. However, the attacker cannot control the content of the overwritten file.

Impact

Exploitation of this vulnerability could lead to arbitrary file overwriting on the server, potentially disrupting services or causing data loss.