mastergo-magic-mcp CVE-2026-15749

Q: What is the CVSS score of CVE-2026-15749?

CVE-2026-15749 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-44541 LOW

Path Traversal (CWE-22)

2026-07-14 cna@vuldb.com

GHSA-r83c-hc4j-pvc5

Path Traversal

1.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local-only attack vector and low privileges required to invoke the MCP tool; partial C/I/A impact with no scope change to other systems.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 12:35 vuln.today

DescriptionCVE.org

A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the component mcp__C2d. Performing a manipulation of the argument filePath results in path traversal. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in mastergo-magic-mcp (versions 0.1 through 0.2.0) allows a locally authenticated low-privilege user to read and write arbitrary files by supplying a crafted filePath argument to the mcp__C2d component's execute function in src/tools/get-c2d.ts. A public proof-of-concept exploit has been released, though the attack surface is constrained to local access, limiting widespread exploitation. No vendor patch is available - the maintainer has not responded to the GitHub issue disclosure.

Technical ContextAI

mastergo-magic-mcp is a Model Context Protocol (MCP) server integration for MasterGo, a collaborative UI design tool analogous to Figma. The vulnerability resides in src/tools/get-c2d.ts within the mcp__C2d MCP tool handler. The execute function accepts a filePath argument and constructs a filesystem path without sanitizing traversal sequences (e.g., ../../), a textbook CWE-22 (Path Traversal) root cause. Because MCP tools expose callable functions to LLM agents and integrated clients, any caller with local access to the MCP runtime can supply attacker-controlled filePath values. Affected versions are 0.1 and 0.2.0 per EUVD-2026-44541 and the NVD reference to the project repository at github.com/mastergo-design/mastergo-magic-mcp.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the responsible disclosure filed as GitHub Issue #88 (https://github.com/mastergo-design/mastergo-magic-mcp/issues/88). Upstream fix availability via patch or tagged release cannot be confirmed. As compensating controls, restrict execution of the mastergo-magic-mcp MCP server to trusted users only, and avoid deploying it in shared-access environments where untrusted local users can invoke MCP tool calls. If the mcp__C2d tool is not required for your workflow, disable or remove the src/tools/get-c2d.ts component from your local installation - note this will break code-to-design functionality. Monitor the GitHub repository for a patched release and apply it promptly when available.