The vulnerability arises from incomplete path normalization in OpenHarness's permission checking logic, allowing an attacker to invoke the built‑in grep and glob utilities with root‑level arguments that bypass configured path restrictions. This grants read access to sensitive local files, such as key material, configuration files, or directory listings, that would normally be protected. The weakness is a classic example of path traversal and falls under CWE‑863.

The affected product is OpenHarness from HKUDS. Version information is not specified in the advisory, so any installation prior to the commit that introduced the fix may be impacted. The fix is present in commit bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae and can be applied by updating to the latest release or by manually merging the changes.

The CVSS score of 8.7 classifies this issue as high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at the time of disclosure. Based on the description, it is inferred that the likely attack vector involves local execution or command injection, as the attacker must execute or influence the built‑in grep and glob commands. Exploitation requires the ability to supply arguments to these utilities, and no special privileges are required beyond those necessary to run OpenHarness.