Image Gen Mcp
Monthly
Path traversal in Ichigo3766 image-gen-mcp 0.1.0 allows a local low-privileged attacker to read or write files outside the intended directory by supplying a crafted `output_path` argument to the `upscale_images` function in `src/index.ts`. The CVSS 4.0 vector includes E:P, indicating proof-of-concept exploit code exists. No vendor patch has been released; the project has not responded to the coordinated disclosure filed via GitHub issue.
Path traversal in Ichigo3766 image-gen-mcp 0.1.0 allows a local low-privileged attacker to read or write files outside the intended directory by supplying a crafted `output_path` argument to the `upscale_images` function in `src/index.ts`. The CVSS 4.0 vector includes E:P, indicating proof-of-concept exploit code exists. No vendor patch has been released; the project has not responded to the coordinated disclosure filed via GitHub issue.