PatchTheCVECVE-2026-40503: OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users w
CVE-2026-40503 is a medium-severity flaw (CVSS 6.5) affecting openharness. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can manipulate the path input parameter to escape the project memory directory and access sensitive files accessible to the OpenHarness process without filesystem containment validation.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 65%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-04-16 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-40503?
openharness: upgrade to 2026-04-13. Exact commands for each OS are on this page.
Is CVE-2026-40503 being exploited?
CVE-2026-40503 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-40503 affect?
CVE-2026-40503 affects openharness. Severity is medium (CVSS 6.5). OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can man
How urgent is CVE-2026-40503?
Priority 37/100. Public exploit reference
Related CVEs
- CVE-2026-40502 HIGH 8.8 UPGRADE OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway user
- CVE-2026-7551 HIGH 8.8 UPGRADE HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remo
- CVE-2026-6823 HIGH 8.2 UPGRADE HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where
- CVE-2026-40516 HIGH 8.3 UPGRADE OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and we
- CVE-2026-6819 HIGH 8.8 UPGRADE HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /p