CVE-2026-40503: OpenHarness Path Traversal Information Disclosure via /memory show
OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can manipulate the path input parameter to escape the project memory directory and access sensitive files accessible to the OpenHarness process without filesystem containment validation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40503?
CVE-2026-40503 is considered a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2026-40503?
To fix CVE-2026-40503, upgrade to OpenHarness version after commit dd1d235, which addresses the path traversal vulnerability.
Who is affected by CVE-2026-40503?
CVE-2026-40503 affects all versions of OpenHarness prior to commit dd1d235, particularly those using the /memory show command.
What kind of attack does CVE-2026-40503 allow?
CVE-2026-40503 allows remote users with chat access to perform path traversal attacks that enable them to read arbitrary files.
What is the nature of the vulnerability in CVE-2026-40503?
The vulnerability in CVE-2026-40503 is a path traversal issue that can lead to unauthorized file access through specific command inputs.