CVE-2026-19327
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A flaw has been found in abracadabra50 claude-sesh 1.0.0, in the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is called 786c9d74800e6d0858b65778f31beb71b3983a50. Applying a patch is advised to resolve this issue.
Risk Assessment
A local attacker can access files outside the allowed directory, potentially leading to disclosure of sensitive data.
Recommendation
It is recommended to apply the available patch (identifier 786c9d74800e6d0858b65778f31beb71b3983a50) to eliminate the vulnerability.
Original NVD description (English source)
A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is called 786c9d74800e6d0858b65778f31beb71b3983a50. Applying a patch is advised to resolve this issue.