Yüksek CVSS 8.1
CVE-2026-46402: CVE-2026-46402: dizin geçişi
Açıklama (NVD)
Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_name value directly when constructing session log paths. An authenticated client can supply path traversal sequences in task_name and cause UFO to create log directories and log files outside the intended logs/ directory.
Özet bilgiler
- CVSS v3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - EPSS
- %0,75 (yüzdelik 55)
- CWE
- CWE-22
- Yama
- Yok / bilinmiyor