| タイトル | 1999AZZAR designer-mcp 789f487c453701a6833aa210db94631f2c7da87a Path Traversal |
|---|
| 説明 | An arbitrary file read vulnerability (CWE-22, Path Traversal) has been identified in the get_reference tool of 1999AZZAR/the-designer.The tool accepts a user-supplied name argument through the MCP get_reference tool, which is directly concatenated into a file system path without any sanitization, normalization, or directory boundary enforcement. An attacker with access to the MCP interface can supply relative paths containing ../ sequences to escape the intended references/ directory and read arbitrary .md files accessible to the server process, potentially leading to unauthorized information disclosure of internal documentation, configuration files, or other sensitive text resources. This is a confirmed vulnerability — dynamic verification via MCP Inspector successfully retrieved the contents of skills/motion-designer/references/motion-dev-guidelines.md by traversing two directory levels upward from the restricted references/ folder. |
|---|
| ソース | ⚠️ https://github.com/1999AZZAR/designer-mcp |
|---|
| ユーザー | lhy- (UID 100899) |
|---|
| 送信 | 2026年09月22日 10:38 (1 月 ago) |
|---|
| モデレーション | 2026年10月24日 15:51 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 426121 [1999AZZAR designer-mcp 迄 2.1.0 MCP Interface motion-dev-guidelines.md get_reference name ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|