| 标题 | 1999AZZAR designer-mcp 789f487c453701a6833aa210db94631f2c7da87a Path Traversal |
|---|
| 描述 | An arbitrary file read vulnerability (CWE-22, Path Traversal) has been identified in the get_reference tool of 1999AZZAR/the-designer.The tool accepts a user-supplied name argument through the MCP get_reference tool, which is directly concatenated into a file system path without any sanitization, normalization, or directory boundary enforcement. An attacker with access to the MCP interface can supply relative paths containing ../ sequences to escape the intended references/ directory and read arbitrary .md files accessible to the server process, potentially leading to unauthorized information disclosure of internal documentation, configuration files, or other sensitive text resources. This is a confirmed vulnerability — dynamic verification via MCP Inspector successfully retrieved the contents of skills/motion-designer/references/motion-dev-guidelines.md by traversing two directory levels upward from the restricted references/ folder. |
|---|
| 来源 | ⚠️ https://github.com/1999AZZAR/designer-mcp |
|---|
| 用户 | lhy- (UID 100899) |
|---|
| 提交 | 2026-09-22 10時38分 (1 月前) |
|---|
| 管理 | 2026-10-24 15時51分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 426121 [1999AZZAR designer-mcp 直到 2.1.0 MCP Interface motion-dev-guidelines.md get_reference name 目录遍历] |
|---|
| 积分 | 20 |
|---|