CVE-2026-46402 Overview
CVE-2026-46402 is a path traversal vulnerability [CWE-22] in Microsoft UFO, an open-source framework for intelligent automation across devices and platforms. The flaw exists in version 3.0.1-4-ge2626659, where the framework uses the user-controlled task_name value directly when constructing session log paths. An authenticated client can supply path traversal sequences in task_name to force UFO to create log directories and files outside the intended logs/ directory. The issue is tracked under GitHub Security Advisory GHSA-whcg-fgpx-76f2.
Critical Impact
Authenticated attackers can write arbitrary files outside the intended log directory, threatening integrity and availability of the host running Microsoft UFO.
Affected Products
- Microsoft UFO open-source framework
- Microsoft UFO version 3.0.1-4-ge2626659
- Deployments accepting client-supplied task_name values
Discovery Timeline
- 2026-05-27 - CVE-2026-46402 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46402
Vulnerability Analysis
Microsoft UFO accepts a task_name parameter from authenticated clients and uses that value directly when building session log paths. The framework does not normalize the input or restrict it to a safe character set. An attacker who controls task_name can embed sequences such as ../ to escape the intended logs/ directory. UFO then creates directories and writes log files at attacker-chosen locations on the host file system. The vulnerability is classified as path traversal under CWE-22.
Root Cause
The root cause is missing input validation on the task_name value before it participates in path construction. UFO concatenates the user-supplied string into a file system path without canonicalizing the result or verifying that the final path resolves within the logs/ base directory. Any traversal token in task_name therefore propagates directly into directory creation and file write operations performed by the logging subsystem.
Attack Vector
Exploitation requires network access and valid authentication to the UFO instance. The attacker submits a task with a crafted task_name containing traversal sequences. UFO interprets the value as a relative path component and creates log artifacts in an unintended location. Depending on the privileges of the UFO process, an attacker can overwrite configuration files, drop files into directories monitored by other services, or fill arbitrary volumes to cause denial of service. The advisory notes integrity and availability impact, with no direct confidentiality loss.
No verified public proof-of-concept code is referenced in the advisory. See the GitHub Security Advisory for additional technical context.
Detection Methods for CVE-2026-46402
Indicators of Compromise
- Log directories or files created outside the configured logs/ base path of the UFO deployment.
- task_name values in request payloads or audit records containing ../, ..\, URL-encoded traversal sequences, or absolute path prefixes.
- Unexpected file writes by the UFO process user account to system, application, or configuration directories.
Detection Strategies
- Inspect UFO request logs for task_name parameters containing path separators, traversal tokens, or encoded variants such as %2e%2e%2f.
- Compare the canonicalized path of each session log against the configured logs base directory and alert on any mismatch.
- Use file integrity monitoring on directories adjacent to and above the UFO logs/ path to flag writes originating from the UFO process.
Monitoring Recommendations
- Forward UFO application logs and host file system audit events to a centralized analytics platform for correlation.
- Alert on creation of new directories by the UFO service account outside its expected working tree.
- Track authenticated session activity that produces high volumes of malformed task_name values, which may indicate enumeration of traversal payloads.
How to Mitigate CVE-2026-46402
Immediate Actions Required
- Restrict network access to UFO instances so only trusted, authenticated clients can submit tasks.
- Rotate or scope down credentials issued to UFO clients that do not require administrative roles.
- Review existing UFO log directories for files written outside the intended logs/ path and treat any such artifacts as suspicious.
Patch Information
Refer to the Microsoft UFO GitHub Security Advisory GHSA-whcg-fgpx-76f2 for fixed version guidance and upgrade instructions. Upgrade Microsoft UFO beyond the affected 3.0.1-4-ge2626659 revision once a patched release is published by the maintainers.
Workarounds
- Validate task_name server-side against an allowlist of alphanumeric characters and reject any value containing path separators or traversal sequences.
- Canonicalize the constructed log path and verify it resides within the configured logs/ base directory before any directory or file creation.
- Run the UFO process under a dedicated low-privilege account with write access limited to the logs/ directory through file system permissions or mandatory access controls.
# Configuration example: restrict UFO process write scope
# Create a dedicated user and constrain writable paths
useradd -r -s /usr/sbin/nologin ufo
chown -R ufo:ufo /opt/ufo/logs
chmod 750 /opt/ufo/logs
# Deny write access to parent directories
chmod o-w /opt/ufo
chattr +i /opt/ufo/config.yaml
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
