CVE-2026-19327: abracadabra50 claude-sesh enricher.ts enrichSession path traversal
A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is called 786c9d74800e6d0858b65778f31beb71b3983a50. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
abracadabra50 claude-seshto a version that resolves this vulnerability.Fixed in 1.0.0Patch 786c9d74800e6d0858b65778f31beb71b3983a50 - Compensating control
Since path traversal requires local attack, restrict local access to the application/host (e.g., limit who can execute or supply requests to the sessionId argument) to reduce the chance of launching an attack that manipulates sessionId.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19327?
The severity of CVE-2026-19327 is rated as medium, with a score of 5.3.
How do I fix CVE-2026-19327?
To fix CVE-2026-19327, update to the patched version of abracadabra50 claude-sesh that addresses the path traversal vulnerability.
What exploit method can be used for CVE-2026-19327?
CVE-2026-19327 can be exploited by manipulating the sessionId argument locally to achieve path traversal.
What are the potential impacts of CVE-2026-19327?
The potential impacts of CVE-2026-19327 include unauthorized access to file system resources due to path traversal.
Which function is affected by CVE-2026-19327?
CVE-2026-19327 affects the getEnrichedData/enrichSession function in the src/services/enricher.ts file.