Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can manipulate the path input parameter to escape the project memory directory and access sensitive files accessible to the OpenHarness process without filesystem containment validation.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40503 OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying pat… https://www.cve.org/CVERecord?id=CVE-2026-40503
Post summary
The text announces a path traversal vulnerability (CVE-2026-40503) in OpenHarness before commit dd1d235 that allows certain users to read arbitrary files.
CVE-2026-40503 Path Traversal in OpenHarness Prior to Commit dd1d235 Allows Arbitrary File Read https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40503
Post summary
The excerpt announces a path traversal vulnerability (CVE-2026-40503) in OpenHarness that permits arbitrary file reads prior to commit dd1d235, with no PoC, exploit, or patch mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hkuds | openharness | - | - | - |