| Title | 1999AZZAR designer-mcp 789f487c453701a6833aa210db94631f2c7da87a Path Traversal |
|---|
| Description | An arbitrary file read vulnerability (CWE-22, Path Traversal) has been identified in the get_reference tool of 1999AZZAR/the-designer.The tool accepts a user-supplied name argument through the MCP get_reference tool, which is directly concatenated into a file system path without any sanitization, normalization, or directory boundary enforcement. An attacker with access to the MCP interface can supply relative paths containing ../ sequences to escape the intended references/ directory and read arbitrary .md files accessible to the server process, potentially leading to unauthorized information disclosure of internal documentation, configuration files, or other sensitive text resources. This is a confirmed vulnerability — dynamic verification via MCP Inspector successfully retrieved the contents of skills/motion-designer/references/motion-dev-guidelines.md by traversing two directory levels upward from the restricted references/ folder. |
|---|
| Source | ⚠️ https://github.com/1999AZZAR/designer-mcp |
|---|
| User | lhy- (UID 100899) |
|---|
| Submission | 09/22/2026 10:38 (1 month ago) |
|---|
| Moderation | 10/24/2026 15:51 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426121 [1999AZZAR designer-mcp up to 2.1.0 MCP Interface motion-dev-guidelines.md get_reference name path traversal] |
|---|
| Points | 20 |
|---|