CVE-2026-19371: Nikolaibibo claude-comfyui-mcp comfy_upload_image utils.ts copyFileSync path traversal
A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfyuploadimage. Such manipulation of the argument imagepath leads to path traversal. An attack has to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19371?
The severity of CVE-2026-19371 is medium with a score of 5.3.
What does CVE-2026-19371 affect?
CVE-2026-19371 affects the copyFileSync function in the comfy_upload_image component of Nikolaibibo claude-comfyui-mcp 1.0.0.
How do I fix CVE-2026-19371?
To fix CVE-2026-19371, ensure that input paths are properly validated to prevent path traversal vulnerabilities.
Is CVE-2026-19371 exploitable remotely?
No, CVE-2026-19371 requires local access to exploit the path traversal vulnerability.
What is a path traversal vulnerability as seen in CVE-2026-19371?
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory.