CVE-2026-116045: 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal
A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function getreference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as c8c2951dcbed9b1710a745993f028317f10a3f10. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
1999AZZAR/designer-mcpto a version that resolves this vulnerability.Patch c8c2951dcbed9b1710a745993f028317f10a3f10
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates low privileges are required. The attack can be launched remotely and does not require user interaction.
Is public exploit code available?
Yes. The vulnerability information states that an exploit is public and may be used.
What is the recommended remediation?
Apply the patch identified as c8c2951dcbed9b1710a745993f028317f10a3f10. The project uses rolling releases, so affected and updated release version details are not available.