CVE-2026-40503

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.5 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N                                    

Vulnerability Description

OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can manipulate the path input parameter to escape the project memory directory and access sensitive files accessible to the OpenHarness process without filesystem containment validation.

Vulnerability Details

Published Date

April 16, 2026

Last Modified

April 17, 2026

CWE ID

CWE-22

Source

NVD

Vendor

HKUDS

Product

OpenHarness

External References

https://github.com/HKUDS/OpenHarness/commit/dd1d235450dd987b20bff01b7bfb02fe8620a0af
https://github.com/HKUDS/OpenHarness/pull/127
https://www.vulncheck.com/advisories/openharness-path-traversal-information-disclosure-via-memory-show

CVE-2026-40503

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment