In bablilayoub openhole versions 0.1.1 and earlier, the openhole-server implementation in internal/server/public_proxy.go forwards r.URL.Path instead of using r.URL.EscapedPath(). This allows percent-encoded dot segments (%2e) and separators (%2f) to be interpreted as directory traversal sequences (../ and /), enabling path traversal attacks that expose localhost services externally. The vulnerability is addressed in version 0.1.2 by properly preserving the original request target encoding.

An attacker can exploit this vulnerability to perform path traversal attacks, exposing internal localhost services to the internet without authentication. This can lead to unauthorized access to sensitive local services, potentially compromising confidentiality. The CVSS score of 8.6 reflects high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact.

A fix is available in bablilayoub openhole version 0.1.2. Users should upgrade to version 0.1.2 or later to remediate this vulnerability. No other official remediation guidance is provided. Patch status is not explicitly stated but the description confirms the issue is fixed in 0.1.2.