CVE-2026-19371
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Nikolaibibo claude-comfyui-mcp 1.0.0, a vulnerability was found in the copyFileSync function of src/tools/utils.ts (comfy_upload_image component). Manipulation of the image_path argument leads to path traversal. The attack must be performed locally.
Risk Assessment
Path traversal vulnerability may allow an attacker to copy files outside allowed locations, potentially leading to data integrity compromise.
Recommendation
It is recommended to validate input paths, use secure path handling functions, and restrict access to the copyFileSync function.
Original NVD description (English source)
A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfy_upload_image. Such manipulation of the argument image_path leads to path traversal. An attack has to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.