Claude Sesh
Monthly
Path traversal in claude-sesh 1.0.0 allows a local attacker with low privileges to escape the intended enrichment directory by supplying a crafted sessionId containing directory traversal sequences to the getEnrichedData or enrichSession functions in src/services/enricher.ts. The unvalidated sessionId is passed directly to path.join(), permitting reads and writes to arbitrary files accessible by the process user account. A proof-of-concept is indicated by the E:P threat metric in the provided CVSS 4.0 vector; no active exploitation or CISA KEV listing is confirmed.
Path traversal in claude-sesh 1.0.0 allows a local attacker with low privileges to escape the intended enrichment directory by supplying a crafted sessionId containing directory traversal sequences to the getEnrichedData or enrichSession functions in src/services/enricher.ts. The unvalidated sessionId is passed directly to path.join(), permitting reads and writes to arbitrary files accessible by the process user account. A proof-of-concept is indicated by the E:P threat metric in the provided CVSS 4.0 vector; no active exploitation or CISA KEV listing is confirmed.