CVE-2026-46402
Description
Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_name value directly when constructing session log paths. An authenticated client can supply path traversal sequences in task_name and cause UFO to create log directories and log files outside the intended logs/ directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Microsoft UFO 3.0.1-4-ge2626659 allows authenticated path traversal via unsanitized task_name in log path construction, enabling arbitrary file creation.
Vulnerability
Microsoft UFO version 3.0.1-4-ge2626659 uses the user-controlled task_name value directly when constructing session log paths. The server accepts task_name from authenticated WebSocket and HTTP task requests without sanitization. In BaseSession, the path is built as f"logs/{task}/" and passed to os.makedirs(), allowing path traversal sequences such as ../ to escape the intended logs/ directory [1].
Exploitation
An authenticated attacker can supply a task_name containing path traversal sequences (e.g., ../../etc/) via WebSocket or HTTP task submission. The server then creates directories and log files at the attacker-controlled filesystem path under the privileges of the UFO server process [1].
Impact
Successful exploitation allows the attacker to create directories and write log files outside the intended logs/ directory. This could lead to overwriting sensitive files, denial of service, or other unintended side effects depending on the server's filesystem permissions [1].
Mitigation
No fix version has been disclosed in the available references. As a workaround, sanitize the task_name input to remove path traversal sequences before using it in filesystem operations [1].
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing input validation on the user-controlled task_name value allows path traversal sequences to escape the intended logs/ directory when constructing session log paths."
Attack vector
An authenticated attacker sends a WebSocket or HTTP task request containing path traversal sequences (e.g., `../`) in the `task_name` field. The UFO server passes this untrusted value into session creation without sanitization. `BaseSession` constructs a log path as `f"logs/{task}/"`, which resolves outside the intended `logs/` directory when `task_name` contains `../`. The server then creates the directory and writes `response.log`, `request.log`, and `evaluation.log` at the attacker-controlled location [ref_id=1].
Affected code
The vulnerability spans multiple files. The WebSocket handler at `ufo/server/ws/handler.py` and the HTTP dispatch path at `ufo/server/services/api.py` both accept an attacker-controlled `task_name` from the client. This value is forwarded through `ufo/server/services/session_manager.py` into `BaseSession` in `ufo/module/basic.py`, where it is used directly to construct `self.log_path = f"logs/{task}/"` and passed to `os.makedirs()` via `ufo/utils/__init__.py`. No validation or normalization is applied to `task_name` at any point in this flow [ref_id=1].
What the fix does
No patch is published in the bundle. The advisory recommends rejecting unsafe `task_name` values containing path separators, `..`, drive prefixes, or absolute paths; generating server-owned opaque directory names for log storage instead of using user-facing task names; normalizing and resolving the final log path and verifying it remains under the intended log root; and using allowlisted characters for any filesystem-facing identifier [ref_id=1].
Preconditions
- authAttacker must be authenticated to the UFO server
- networkAttacker must be able to submit tasks via WebSocket or HTTP
- inputAttacker supplies path traversal sequences (e.g., ../) in the task_name field
Reproduction
The advisory includes a full Python PoC that instantiates a minimal `BaseSession` subclass with `task="../ufo_taskname_escape_poc"`. Run with `UFO_REPO=/path/to/UFO python -B embedded_poc.py`. The PoC verifies the source code paths, creates a `DummySession` with the traversal payload, and confirms that `log_path` resolves outside `logs/` and that `response.log`, `request.log`, and `evaluation.log` are created at the escaped location [ref_id=1].
Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.