CVE-2026-40503

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada hkuds openharness. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can manipulate the path input parameter to escape the project memory directory and access sensitive files accessible to the OpenHarness process without filesystem containment validation.

Rincian

Terbit di NVD

16 April 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/HKUDS/OpenHarness/commit/dd1d235450dd987b20bff01b7bfb02fe8620a0af patch
• https://www.vulncheck.com/advisories/openharness-path-traversal-information-disclosure-via-memory-show advisory pihak ketiga
• https://github.com/HKUDS/OpenHarness/pull/127 exploit · issue tracking