CVE-2026-19372
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Handwriting-OCR handwriting-ocr-mcp-server 0.1.0, a vulnerability was found in the fs.readFileSync function of src/index.ts (upload_document component). Manipulation of the File argument leads to path traversal. The attack requires local access.
Risk Assessment
Path traversal vulnerability may allow an attacker to read arbitrary files on the server, potentially leading to disclosure of sensitive data.
Recommendation
It is recommended to validate file paths, use an allowlist of permitted directories, and avoid direct use of the File argument in file operations.
Original NVD description (English source)
A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component upload_document. Performing a manipulation of the argument File results in path traversal. Attacking locally is a requirement. The project was informed of the problem early through an issue report but has not responded yet.