CVE-2026-40503 is a path traversal vulnerability in HKUDS OpenHarness versions prior to commit dd1d235. Remote users with chat access can exploit the /memory show slash command by manipulating the path input parameter with traversal sequences to bypass directory restrictions. This allows reading arbitrary files outside the intended project memory directory without proper filesystem containment validation. The vulnerability is classified under CWE-22 and has a CVSS 4.0 score of 7.1 (high severity). No official patch or remediation level has been provided as of the published date.

An attacker with remote gateway chat access can read arbitrary files on the system running OpenHarness by exploiting the path traversal vulnerability. This could lead to disclosure of sensitive information accessible to the OpenHarness process. There is no indication of privilege escalation, code execution, or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor access to the chat interface for untrusted users to reduce exposure. Avoid exposing the vulnerable /memory show slash command to untrusted parties.