OpenHarness before commit dd1d235 suffered from a path‑traversal flaw in the /memory show command. A remote user with chat access can supply traversal sequences that cause the OpenHarness process to read any file reachable in the file system, leading to unintended disclosure of sensitive data. The vulnerability relies on lack of filesystem containment checks when resolving the input path (CWE-22).

Affected systems are deployments of OpenHarness using a version prior to commit dd1d235450dd987b20bff01b7bfb02fe8620a0af, provided by the HKUDS vendor. The flaw exists in all installations that expose the /memory show command to chat users.

The CVSS score of 7.1 indicates moderate to high risk, while the EPSS score is below 1%, suggesting a low but non-zero exploitation probability. The requirement of remote gateway chat access limits the threat to environments where such access is granted. Attackers can retrieve arbitrary files through the web API using a simple HTTP request to the /memory show slash command, resulting in a confidentiality breach with potential operational impact.