Microsoft UFO, an open-source framework for intelligent automation, in version 3.0.1-4-ge2626659, improperly limits pathname input when constructing session log paths. Specifically, it uses the user-supplied task_name value without sanitization, allowing an authenticated client to include path traversal sequences. This results in the creation of log files and directories outside the designated logs/ directory, violating intended directory restrictions. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-73 (External Control of File Name or Path). The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

An authenticated attacker can cause Microsoft UFO to create or modify files outside the intended logs/ directory by exploiting path traversal sequences in the task_name parameter. This can lead to unauthorized file system modifications, potentially impacting the integrity and availability of the system. There is no confidentiality impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users carefully and monitor for suspicious task_name inputs if possible. Avoid exposing the vulnerable version in untrusted environments. Do not assume the vulnerability is mitigated without vendor confirmation.