CVE-2026-46402 Details

A path traversal vulnerability has been identified in the Microsoft UFO open-source framework, specifically in version 3.0.1-4-ge2626659. The issue arises because the framework directly uses the user-controlled 'task_name' value to construct session log paths, without proper sanitization. This allows authenticated clients to manipulate 'task_name' with path traversal sequences, causing UFO to create log directories and files outside the designated 'logs/' directory. The vulnerability can be exploited by sending crafted 'task_name' values through authenticated WebSocket or HTTP task requests, which are then processed by the UFO server. The server's session management system fails to validate or normalize these task names before using them to generate filesystem paths, leading to unauthorized file creation and log writes at locations influenced by the attacker, under the privileges of the UFO server process.

To address this vulnerability, it is recommended to implement proper validation and sanitization of the 'task_name' values before they are used to create log paths. This includes rejecting names that contain path separators, traversal sequences, or absolute paths. Additionally, UFO should generate opaque directory names for log storage that are not user-controlled, and ensure that all log file creations are confined to safe, intended locations.