This vulnerability affects the importFiles function within the ImportFile API of h2oai h2o-3 up to version 7402. It allows remote attackers to manipulate the function in a way that leads to information disclosure. The vulnerability does not require privileges or user interaction and has a low complexity for exploitation. The vendor has not provided any response or patch, and no official remediation level is indicated. Public exploit code exists, increasing the risk of potential exploitation.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information from the affected system. The vulnerability can be exploited remotely without authentication or user interaction, which increases its risk. However, the impact is limited to information disclosure with no indication of further compromise such as integrity or availability impacts. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor vendor channels for updates. In the meantime, restricting network access to the ImportFile API and applying compensating controls to limit exposure may reduce risk.