CVE-2026-19327
Received Received - Intake

Path Traversal in abracadabra50 claude-sesh

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is called 786c9d74800e6d0858b65778f31beb71b3983a50. Applying a patch is advised to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19327
EUVD
EUVD-2026-54858

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
abracadabra50 claude-sesh 1.0.0
abracadabra50 claude-sesh 1.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the claude-sesh tool version 1.0.0. It occurs in the getEnrichedData/enrichSession function where user-controlled sessionId values are used directly in file path construction without validation. Attackers can manipulate the sessionId to include path traversal sequences like ../ or absolute paths, allowing them to access or overwrite files outside the intended ~/.claude-sesh/enriched directory.

Detection Guidance

To detect this vulnerability, inspect the claude-sesh application for improper session ID handling. Check if session IDs are used directly in file paths without validation. Look for path traversal patterns like '../' or absolute paths in session IDs. Review the enricher.ts file for functions like getEnrichedData or enrichSession that construct file paths using sessionId without sanitization.

Impact Analysis

This vulnerability allows local attackers to read or modify arbitrary files on your system that the application has access to. If exploited, it could lead to unauthorized data access, file corruption, or even system compromise depending on the files targeted. The impact is limited to local attacks as specified in the vulnerability details.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized access to sensitive local files through path traversal. If exploited, it may lead to unauthorized data exposure or modification, violating confidentiality requirements in both regulations.

Mitigation Strategies

Apply the patch from commit 786c9d74800e6d0858b65778f31beb71b3983a50. Ensure session IDs are validated against a safe character set like [A-Za-z0-9_-]. Use the new enrichedPathFor() function to validate paths and restrict operations to the ENRICHED_DIR. Update to the latest version of claude-sesh if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19327. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart