---
id: CVE-2026-40503
title: OpenHarness Path Traversal Information Disclosure via /memory show
summary: >-
  OpenHarness prior to commit dd1d235 contains a path traversal vulnerability
  that allows remote gateway users with chat access to read arbitrary files by
  supplying path traversal sequences to the /memory show slash command.
  Attackers can …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: HKUDS
product: OpenHarness
affected:
  - OpenHarness < dd1d235450dd987b20bff01b7bfb02fe8620a0af
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-16T13:40:58.633483Z'
published: '2026-04-16'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:49.847Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-40503'
references:
  - url: 'https://github.com/HKUDS/OpenHarness/pull/127'
  - url: >-
      https://github.com/HKUDS/OpenHarness/commit/dd1d235450dd987b20bff01b7bfb02fe8620a0af
  - url: >-
      https://www.vulncheck.com/advisories/openharness-path-traversal-information-disclosure-via-memory-show
tags:
  - cve.org
epss: 0.00414
epssPercentile: 0.35953
ingestedAt: '2026-11-08T14:51:22.443Z'
---

## Overview

OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can manipulate the path input parameter to escape the project memory directory and access sensitive files accessible to the OpenHarness process without filesystem containment validation.

## Affected

- `OpenHarness < dd1d235450dd987b20bff01b7bfb02fe8620a0af`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.