Executive brief
Microsoft UFO is an open-source framework used to automate tasks across different devices and platforms. A security vulnerability allows an authenticated user to manipulate task names to create files and folders in unauthorized locations on the server's filesystem. This could allow an attacker to disrupt operations or potentially overwrite sensitive system files, depending on the server's configuration.
Technical details
A path traversal vulnerability exists in Microsoft UFO version 3.0.1-4-ge2626659 due to improper sanitization of the 'task_name' parameter. The UFO server accepts this value via WebSocket or HTTP task requests and passes it directly to the BaseSession class, which constructs a filesystem path using an f-string (f"logs/{task}/"). Because the application calls os.makedirs() and subsequent file write operations on this unsanitized path, an authenticated attacker can use traversal sequences (e.g., '../') to create directories and log files (response.log, request.log, evaluation.log) anywhere the server process has write permissions. This can lead to arbitrary file creation or integrity issues on the host system. As of the advisory date, no patched version is specified.
Affected products
- Microsoft UFO 3.0.1-4-ge2626659
Timeline
- 2026-05-13: advisory: GitHub advisory published by maintainers
- 2026-05-27: disclosed: CVE published to NVD