CVE-2026-7234
Path Traversal in BrowserOperator Core Allows Remote Exploits
Publication date: 2026-04-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| browseroperator | browser-operator-core | to 0.6.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a path traversal issue in the BrowserOperator browser-operator-core project, specifically in the function startsWith within the file scripts/component_server/server.js. It occurs because the server uses the HTTP request URL directly to determine file paths without proper sanitization.
Attackers can manipulate the request URL to include traversal sequences like "../" to access files outside the intended directories. This allows remote attackers with network access to read arbitrary files on the server that the process has permission to access.
The vulnerability affects both normal mode and a special "--traces" mode, where a weak boundary check using startsWith allows traversal to sibling directories with similar prefixes, further expanding the scope of accessible files.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to remotely read arbitrary files on the server running the browser-operator-core component server. This can lead to exposure of sensitive or confidential information stored in files accessible by the server process.
The impact is primarily on confidentiality, as the attacker can read files but cannot modify them (no integrity impact) or cause significant denial of service (low availability impact).
If the server is exposed beyond localhost or contains sensitive files, the risk and impact increase.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted HTTP GET requests to the component server that include path traversal sequences such as "../" in the URL path. For example, requests like `/front_end/ui/components/docs/../../secret.txt` can be used to test if arbitrary files outside the intended directory are accessible.
A practical detection method is to use curl commands targeting the local component server HTTP endpoint to attempt to read files outside the documentation or trace directories.
- curl http://localhost:<port>/front_end/ui/components/docs/../../secret.txt
- curl http://localhost:<port>/t/../traces_evil/secret.json (for "--traces" mode)
If these requests return file contents outside the expected directories, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include not exposing the component server to untrusted users or networks.
Avoid running the server in directories containing sensitive files under the affected paths.
Restrict usage of the component server to trusted development or continuous integration (CI) environments.
Disable the "--traces" mode if it is not necessary, as it exacerbates the vulnerability.
Longer term, the recommended fix involves normalizing and resolving all user-controlled request paths before filesystem access, enforcing directory boundaries using canonical path checks (e.g., using path.relative()), rejecting paths containing traversal components before calling filesystem functions, and adding regression tests to prevent traversal and sibling directory access.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to perform path traversal attacks, potentially exposing readable files outside the intended directories.
This exposure of files could lead to unauthorized disclosure of sensitive information, which may impact compliance with data protection regulations such as GDPR or HIPAA if the exposed files contain personal or protected health information.
Mitigations include restricting access to trusted environments and not exposing the component server to untrusted users, which are important steps to maintain compliance.