CVE-2026-46402: Path Traversal in Microsoft UFO Framework – Patch Guidance

Technical summary

CVE-2026-46402 is a path traversal vulnerability (CWE-22, CWE-73) in Microsoft UFO's session logging mechanism. The framework fails to sanitize the user-supplied task_name parameter before using it to construct file system paths for session logs. An authenticated attacker can inject path traversal sequences (such as ../ or absolute paths) into task_name to escape the logs/ directory and write or modify arbitrary files on the system, subject to the privileges of the UFO process.

Business impact

Organizations using UFO for automated workflows face risk of data integrity compromise, potential denial of service through filesystem exhaustion, and confidentiality loss if sensitive configuration or state files are overwritten. In multi-tenant or shared environments, this could enable lateral privilege escalation or cross-tenant interference. The impact depends on the process's file system privileges and what sensitive data resides on the same system.

Affected systems

Microsoft UFO framework version 3.0.1-4-ge2626659 is explicitly affected. Organizations should audit their UFO deployments to determine current version status. The vulnerability requires authentication, so only systems exposed to trusted internal users or accessible via authentication credentials are at risk.

Exploitability

Exploitation requires valid authentication credentials to interact with UFO—this is a low barrier for insider threats or compromised service accounts. No complex interaction or user interaction is needed; an authenticated client can immediately craft a malicious task_name and trigger file creation or modification. The attack is network-accessible, making it suitable for exploitation by remote authenticated users.

Remediation

Update Microsoft UFO to a patched version that sanitizes the task_name parameter before constructing log file paths. Verify the specific patched version against the Microsoft Security Advisory for UFO. Until patching is complete, restrict UFO access to trusted accounts and monitor log directory creation and file system activity for unexpected paths.

Patch guidance

Consult the official Microsoft UFO GitHub repository or security advisory for the specific patched version. Apply the update to all systems running version 3.0.1-4-ge2626659. Verify that the patch properly validates and sanitizes task_name input, rejecting or escaping path traversal sequences. Test in a non-production environment before rolling out to production automation workflows.

Detection guidance

Monitor UFO process file system activity for writes outside the intended logs/ directory, especially following task submission requests. Log aggregation rules should flag task_name parameters containing ../, absolute paths (/), or unusual encoding patterns. Review UFO session logs and filesystem audit logs for unexpected directory creation or file modifications that correlate with task execution events.

Why prioritize this

This vulnerability scores 8.1 (HIGH) due to high integrity and availability impact combined with low attack complexity and network accessibility. Although authentication is required, the ability to write arbitrary files on an authenticated system poses significant risk in automation-critical environments. Organizations relying on UFO for business-critical processes should prioritize patching.

Risk score, explained

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H yields 8.1 HIGH. Network accessibility (AV:N) and low attack complexity (AC:L) increase risk; the low privilege requirement (PR:L) reflects that any authenticated user can exploit it. The high integrity impact (I:H) and high availability impact (A:H) reflect the severity of uncontrolled file write capability, while confidentiality is unaffected (C:N).

Frequently asked questions