PT-2026-35672 · Unknown · Browser-Operator-Core

Brucejin · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7234

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BrowserOperator browser-operator-core versions prior to 0.6.1

Description A path traversal issue exists in the startsWith() function within the scripts/component server/server.js file. A remote attacker can exploit this by manipulating the request.url variable, potentially allowing unauthorized access to files or directories outside the intended folder.

Recommendations As a temporary workaround, restrict access to the startsWith() function in the scripts/component server/server.js file or avoid using the request.url variable in the affected component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7234

Affected Products

Browser-Operator-Core

References · 10

• 🔥 https://github.com/BrowserOperator/browser-operator-core/issues/96 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7234 · Security Note
• https://vuldb.com/submit/802762 · Note
• https://t.me/CVEtracker/52042 · Telegram Post
• https://twitter.com/infoflowcloud/status/2049029817438208253 · Twitter Post
• https://vuldb.com/vuln/359843/cti · Note
• https://github.com/BrowserOperator/browser-operator-core · Note
• https://twitter.com/CVEnew/status/2049028375118045187 · Twitter Post
• https://vuldb.com/vuln/359843 · Note
• https://twitter.com/VulmonFeeds/status/2049160118722294233 · Twitter Post