EUVD-2026-54958
GHSA-g57q-682f-hr5f
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring low privileges; all three impacts bounded to Low as traversal is constrained to files accessible by the server process account.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfy_upload_image. Such manipulation of the argument image_path leads to path traversal. An attack has to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in claude-comfyui-mcp 1.0.0 enables local low-privileged users to escape the intended upload directory by supplying crafted ../ sequences as the image_path argument to the comfy_upload_image tool. The unsanitized input is passed directly to Node.js copyFileSync in src/tools/utils.ts, allowing reads or writes to arbitrary files accessible by the server process. A proof-of-concept exists (CVSS 4.0 E:P), and the project maintainer has not responded to responsible disclosure, leaving no vendor patch available at time of analysis.
Technical ContextAI
claude-comfyui-mcp is a Model Context Protocol (MCP) server that bridges Claude AI with ComfyUI, a node-based Stable Diffusion image generation interface. The vulnerable code path is in src/tools/utils.ts within the comfy_upload_image component, which calls Node.js's synchronous copyFileSync without first canonicalizing or bounding the caller-supplied image_path. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) is the root cause class: the application fails to resolve the path against an allowed base directory and reject traversal sequences before performing the filesystem operation. The CPE string cpe:2.3:a:nikolaibibo:claude-comfyui-mcp:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected range to a specific version - all currently known releases are considered affected.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the responsible disclosure filed at https://github.com/Nikolaibibo/claude-comfyui-mcp/issues/3. Monitor that issue and the repository for any patched release and apply it immediately upon availability. Until then, restrict local system access to trusted users only, since exploitation requires a local authenticated session. As a source-level compensating control, modify src/tools/utils.ts to resolve image_path to an absolute path using path.resolve() and then assert it starts with the permitted upload base directory before invoking copyFileSync; reject or sanitize any path that falls outside the allowed root. This change would need to be applied as a local fork. Trade-off: this manual patch requires maintaining a private fork and re-applying any upstream changes. Avoid running the MCP server under elevated privileges, as this limits the blast radius of a successful traversal to files readable/writable by the low-privilege process account. Full VulDB advisory: https://vuldb.com/cve/CVE-2026-19371.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today