EUVD-2026-54886
GHSA-xgwr-j735-3wg4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector and low privileges confirmed by description and patch; no availability impact; confidentiality and integrity both low due to constrained file-write primitive.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access. Upgrading to version 2.2.7 is capable of addressing this issue. The patch is named 9c7a7839e690bb4543f0e7481b5740d23808e5fe. It is advisable to upgrade the affected component.
AnalysisAI
Path traversal in Pimzino spec-workflow-mcp versions up to 2.2.6 allows a local low-privileged user to write approval files outside the intended .spec-workflow/approvals directory by supplying crafted values such as '../../../etc/cron.d/evil' as the categoryName argument to ApprovalStorage.createApproval(). The vulnerability is strictly local (AV:L, PR:L) and carries a CVSS 4.0 score of 4.8, indicating limited blast radius. No public exploit code and no CISA KEV listing exist at time of analysis; version 2.2.7, released 2026-05-04, fully remediated the issue.
Technical ContextAI
spec-workflow-mcp is a Node.js/TypeScript MCP (Model Context Protocol) tool for spec-driven workflow management, identified by CPE cpe:2.3:a:pimzino:spec-workflow-mcp:*:*:*:*:*:*:*:*. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In the vulnerable code path, src/dashboard/approval-storage.ts directly concatenated the user-supplied categoryName into a filesystem path using Node.js path.join(this.approvalsDir, categoryName) without any sanitization, allowing sequences like ../../../etc/passwd or null-byte injections to escape the approvals subdirectory. The patch (commit 9c7a7839e690bb4543f0e7481b5740d23808e5fe) introduced a PathUtils.validateSimplePathSegment() function that rejects any categoryName containing '..', '/', '\', or null bytes, and replaced all raw join() calls with a bounds-enforcing PathUtils.safeJoin() utility. Defense-in-depth validation was added at both the MCP tool handler layer (src/tools/approvals.ts) and the storage layer (src/dashboard/approval-storage.ts).
RemediationAI
Upgrade to spec-workflow-mcp version 2.2.7, released 2026-05-04, which is the vendor-confirmed patched release. The fix is implemented in commit 9c7a7839e690bb4543f0e7481b5740d23808e5fe (https://github.com/Pimzino/spec-workflow-mcp/commit/9c7a7839e690bb4543f0e7481b5740d23808e5fe) and merged via pull request #222 (https://github.com/Pimzino/spec-workflow-mcp/pull/222). If immediate upgrade is not possible, restrict local system access to the MCP server process so that only fully trusted users can invoke MCP tools - this eliminates the threat since exploitation requires local low-privileged access. Alternatively, wrap the MCP tool invocation layer to validate and reject categoryName values containing '..', '/', or '\' as an application-level firewall control, though this duplicates what the 2.2.7 patch already provides. There are no known side effects of upgrading to 2.2.7.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today