CVE-2026-19323 azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversal

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-19323

CVE-2026-19323 affects the generateProjectDocs function in src/index.ts of the analyze-projec component of the azer react-analyzer-mcp. The vulnerability arises from manipulation of the projectName argument, which can lead to path traversal. Exploitation is described as requiring local access. Th...

EUVD-2026-54837

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-19323

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-19323 azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversal

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-19330: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function createsystemjson/createlibrary to getsystemjson/switchmemorylibrary of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was...

PT-2026-69249

Name of the Vulnerable Software and Affected Versions Jevon-Zhong Ai-doctor version 0.0.1 Description A path traversal issue exists in the deleteImage function within the ai-doctor-server/src/filemanagement/filemanagement.service.ts file. This occurs when the imagePath argument is manipulated,...

PT-2026-69254

Name of the Vulnerable Software and Affected Versions angrysky56 advanced-reasoning-mcp version 1.0.0 Description A path traversal issue exists in the file src/index.ts within the functions create system json, create library, get system json, and switch memory library. Path traversal is a flaw th...

CVE-2026-10595: Relative Path Traversal

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

PT-2026-69247

Name of the Vulnerable Software and Affected Versions HelloGGX shadcn-vue-mcp versions up to e170e277b94235cde627803277fc8c41103a4d38 Description A path traversal issue exists in the fs.promises.readFile function within the src/server/callback-server.ts file. This occurs when the filepath argumen...

CVE-2026-19372: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

CVE-2026-19326: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...

PT-2026-69307

Name of the Vulnerable Software and Affected Versions Ichigo3766 image-gen-mcp version 0.1.0 Description A path traversal issue exists within the upscale images component in the src/index.ts file. A local attacker can manipulate the output path argument to access or overwrite files outside the...

PT-2026-69248

Name of the Vulnerable Software and Affected Versions IncomeStreamSurfer roo-code-memory-bank-mcp-server versions up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e Description A path traversal issue exists in the read memory bank file/append memory bank entry component within the src/index.ts file...

PT-2026-69314

Name of the Vulnerable Software and Affected Versions bartekke8it56w2 new-mcp version 0.1.0 Description A path traversal issue exists within the geminithinking component in the file index.ts. The flaw occurs when the sessionCommand or sessionPath arguments are manipulated, affecting the...

CVE-2026-19368: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the component geminisearch/geminireason/geminiprocess/geminianalyze. The manipulation of the argument filepath/filepaths results in path...

PT-2026-69260

Name of the Vulnerable Software and Affected Versions Pimzino spec-workflow-mcp versions prior to 2.2.7 Description A path traversal issue exists in the ApprovalStorage.createApproval function within the src/tools/approvals.ts file. This occurs when the categoryName argument is manipulated,...

PT-2026-69315

Name of the Vulnerable Software and Affected Versions Nikolaibibo claude-comfyui-mcp version 1.0.0 Description A path traversal issue exists in the comfy upload image component within the src/tools/utils.ts file. The copyFileSync function does not properly validate the image path argument, allowi...

PT-2026-69279

Name of the Vulnerable Software and Affected Versions automateyournetwork MCPyATS versions prior to 0.1.5 Description A path traversal issue exists in the generate mermaid markdown component within the processGenerateRequest function located in the mcp servers/mermaid/index.ts file. A local...

PT-2026-69310

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP versions prior to 1.0.25 Description A path traversal flaw exists within the insert creds range config component, specifically in the src/tools/insertCredsRangeConfig.ts file. A local attacker can manipulate the configPa...