CVE-2026-19270
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Hulupeep mcp-ui-probe project up to version 0.2.0, a path traversal vulnerability was found in the get_journey/delete_journey/analyze_journey/usage_stats functions in src/journey/JourneyStorage.ts of the Journey/Usage component. Manipulating the journeyId/filename arguments allows access to files outside the allowed directory. The attack requires local access.
Risk Assessment
Path traversal could allow a local attacker to read or delete arbitrary files on the system, potentially leading to data leakage or system damage.
Recommendation
Restrict local access and monitor the project's response. Consider validating paths in the code or temporarily disabling the affected functions.
Original NVD description (English source)
A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path traversal. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.