CVE-2026-40503Medium· 6.5▾ SunlitOpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can manipulate the path input parameter to escape the project memory directory and access sensitive files accessible to the OpenHarness process without filesystem containment validation.
OpenHarness < dd1d235450dd987b20bff01b7bfb02fe8620a0afRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-40502High· 8.8OpenHarness Remote Administrative Command Injection via Gateway Handler
CVE-2026-22682High· 7.1OpenHarness Improper Access Control via File Tools
CVE-2026-40515High· 7.5OpenHarness Permission Bypass via grep and glob root argument
CVE-2026-40516High· 8.3OpenHarness SSRF via web_fetch and web_search
CVE-2026-58170High· 8.3Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates
CVE-2026-58171Medium· 4.2Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier