CVE-2024-5986 is a critical vulnerability in h2oai/h2o-3 version 3.46.0.1 and earlier that allows remote attackers to write arbitrary data to any file on the server. This is done by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which can then be exported via the /3/Frames/framename/export endpoint. The vulnerability can lead to remote code execution and full system compromise by overwriting critical files such as private SSH keys or scripts.