CVE-2026-46402: Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory

Synopsis

Path traversal vulnerability in Microsoft UFO, an open-source intelligent automation framework, allows an authenticated attacker to supply directory traversal sequences (such as "../") in the task_name parameter, which UFO uses without sanitization when constructing session log paths. The attack is reachable over the network and requires only a low-privilege account; no victim interaction is needed. Successful exploitation lets the attacker create arbitrary directories and log files outside the intended logs/ directory, tampering with the filesystem and potentially disrupting service. No fix version has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends a crafted task_name value to the remotely exposed UFO endpoint.

• AuthenticationRequired

  A valid account is needed to reach the log-path construction logic, though any low-privilege account is sufficient.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker submits the malicious request directly.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• Attacker creates arbitrary directories and log files at any filesystem path the UFO process has write access to, bypassing the intended logs/ directory boundary.
• Attacker overwrites or pollutes existing files outside the log directory if the process has sufficient permissions, corrupting application or system state.
• Repeated or large-scale log writes to unexpected locations fill disk space on sensitive partitions, crashing the affected service or co-located services that depend on that storage.