Mcp Ui Probe
Monthly
Path traversal in Hulupeep mcp-ui-probe 0.1-0.2.0 allows a local authenticated user to read, write, or delete arbitrary files by manipulating the journeyId or filename arguments passed to the Journey and Usage API functions in JourneyStorage.ts. The CVSS 4.0 E:P supplemental metric confirms publicly available proof-of-concept exploit code exists, raising real-world risk above what the moderate base score alone suggests. No vendor patch is available; the project has not responded to the responsible disclosure submitted via GitHub issue.
Path traversal in Hulupeep mcp-ui-probe 0.1-0.2.0 allows a local authenticated user to read, write, or delete arbitrary files by manipulating the journeyId or filename arguments passed to the Journey and Usage API functions in JourneyStorage.ts. The CVSS 4.0 E:P supplemental metric confirms publicly available proof-of-concept exploit code exists, raising real-world risk above what the moderate base score alone suggests. No vendor patch is available; the project has not responded to the responsible disclosure submitted via GitHub issue.