CVE-2026-82111: iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal
A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component uploadimage. Performing a manipulation of the argument imagepath results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.5.1 is sufficient to fix this issue. The patch is named 7f9a215e03575c650d38c8f87fc6d8d363fed80d. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
iswalle/getnote-mcp/upload_imageto a version that resolves this vulnerability.Fixed in 1.5.1Patch 7f9a215e03575c650d38c8f87fc6d8d363fed80d
Event History
Frequently Asked Questions
Which deployments are affected?
getnote-mcp versions up to and including 1.5.0 are affected in the upload_image component's handling of the image_path argument. Version 1.5.1 fixes the issue.
What access does an attacker need?
The attack can be initiated remotely, but the supplied severity vector indicates low privileges are required. No user interaction is required.
What is the impact of successful exploitation?
An attacker can manipulate image_path to perform path traversal through fs.readFileSync, potentially disclosing data readable by the affected process. The provided scoring indicates low confidentiality impact and no integrity or availability impact.
What should teams do if they cannot upgrade immediately?
The provided data identifies upgrading to version 1.5.1 as the remediation and does not specify a workaround. Prioritize restricting access to low-privileged users and review uses of the upload_image image_path input until the upgrade can be applied.