CVE-2026-19327 in claude-sesh
Summary
by MITRE • 08/09/2026
A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is called 786c9d74800e6d0858b65778f31beb71b3983a50. Applying a patch is advised to resolve this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
This vulnerability represents a path traversal flaw in the abracadabra50 claude-sesh 1.0.0 application that specifically affects the getEnrichedData/enrichSession function within the src/services/enricher.ts file. The issue stems from inadequate input validation and sanitization of the sessionId parameter, which allows malicious actors to manipulate the argument value in a way that could potentially traverse directory structures. This type of vulnerability falls under CWE-23 Path Traversal and aligns with ATT&CK technique T1059 Command and Scripting Interpreter where adversaries may leverage path traversal to access unauthorized files or directories. The attack vector requires local execution, indicating that the vulnerability is not directly exploitable over a network but rather through a compromised local environment or legitimate user with access to the system.
The technical implementation of this flaw suggests that the application likely constructs file paths using user-supplied session identifiers without proper sanitization or validation mechanisms. When the sessionId argument is processed, it may be directly concatenated or used within file system operations without adequate checks to prevent directory traversal sequences such as ../ or ..\ that could allow access to files outside the intended directory scope. This vulnerability essentially allows an attacker with local access to potentially read arbitrary files from the system by manipulating the session identifier parameter.
The operational impact of this vulnerability is significant for local environments where the application runs, as it could potentially expose sensitive data stored in file systems that would normally be protected by proper access controls. An attacker who gains local access could leverage this flaw to access session data, configuration files, or other sensitive information that might contain credentials, personal data, or system configurations. The vulnerability's local execution requirement means that it doesn't represent a direct network threat but rather a concern for privilege escalation scenarios where an attacker already has local system access.
Mitigation strategies should focus on implementing proper input validation and sanitization of the sessionId parameter before any file system operations are performed. The recommended approach involves applying the patch with commit hash 786c9d74800e6d0858b65778f31beb71b3983a50 which should properly sanitize user inputs and implement proper path validation. Additional security measures include implementing whitelisting of valid session identifiers, using secure file system operations that prevent path traversal attempts, and ensuring proper access controls are in place for the application's file system interactions. Organizations should also consider implementing principle of least privilege and regular security audits to identify similar vulnerabilities in other components of their applications. The patch implementation should be tested thoroughly to ensure it resolves the vulnerability without introducing regressions in the application's functionality while maintaining compliance with security standards such as those outlined in NIST SP 800-53 control CM-7 Configuration Management and ISO/IEC 27001 controls A.12.6.1 Information Security for System Development and A.13.2.3 Secure System Architecture.