The vulnerability allows an authenticated user to supply a task_name that contains directory traversal sequences, which Microsoft UFO uses directly when building the session log path. This flaw lets the attacker create directories and files outside the intended logs directory, potentially tampering with logs or creating non‑log files. The weakness maps to CWE-22 (Path Traversal) and CWE-73 (Incorrect Log File Path). The impact is the ability to write files in unintended locations with the privileges of the UFO process, which may facilitate persistence or tampering.

Microsoft UFO, version 3.0.1-4-ge2626659, is impacted. The vulnerability exists in the log path construction logic and applies to all installations of this specific release running on any platform the framework supports.

The CVSS score of 8.1 indicates a high severity vulnerability. With an authenticated attacker who can control the task_name, exploitation does not require additional privileges beyond those granted to a user able to create tasks. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the high CVSS suggests that detection and remediation should be treated as a priority. The attack path is straightforward: supply a crafted task_name during task creation or task configuration and trigger log generation, causing UFO to write files outside the logs directory.