CVE-2024-45388: Hoverfly simulation API path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityNetwork-reachable unauthenticated arbitrary file read with a high EPSS score and public exploit detail, though no confirmed in-the-wild exploitation.

What it is

Hoverfly's POST /api/v2/simulation handler builds a file path from user-supplied input without confirming the resolved path stays inside the configured responses body files base directory. Although absolute paths are rejected, ../ segments let an attacker escape the base path and read arbitrary files from the Hoverfly server. This is a high-severity information disclosure issue in a tool often run in shared test and CI environments.

Impact

An attacker can read any file the Hoverfly process can access, exposing configuration, credentials, tokens and source material on the host. There is no integrity or availability impact; the gain is confidential data.

Attack surface

Reached over the network through the Hoverfly HTTP API endpoint POST /api/v2/simulation; the CVSS vector shows no privileges and no user interaction required. Any party able to reach the API can attempt the traversal.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high at roughly 0.556 (99th percentile), and the vendor advisory reference is tagged Exploit, indicating public exploit detail exists.

What to do

• Upgrade Hoverfly to v1.10.3 or later, which contains the fix.
• If immediate upgrade is not possible, restrict network access to the Hoverfly API to trusted clients only.
• Validate that any resolved file path is contained within the configured responses body files base path before use.
• Run Hoverfly with least privilege and avoid placing sensitive files within reach of the service account.
• Review exposure of the simulation API in CI and shared test environments and disable it where not needed.

Detection

• Monitor Hoverfly logs and API access logs for POST /api/v2/simulation requests containing ../ sequences or unusual file paths.
• Alert on file reads by the Hoverfly process outside its configured responses body files directory.
• Audit outbound or subsequent use of files read via the simulation endpoint for signs of credential or configuration exfiltration.
• Check for unexpected simulation objects or response body file references created through the API.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.