CVE-2026-15749

Deferred Deferred - Pending Action

Path Traversal in MasterGo Design Magic MCP

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: VulDB

Description

A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the component mcp__C2d. Performing a manipulation of the argument filePath results in path traversal. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-15749

Affected Vendors & Products

Vendor	Product	Version / Range
mastergo	mastergo-magic-mcp	to 0.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal flaw in the mastergo-design mastergo-magic-mcp tool up to version 0.2.0. It exists in the execute function of src/tools/get-c2d.ts, specifically in the mcp__C2d component. An attacker can manipulate the filePath argument to access unauthorized files on the system. The attack requires local access and a public exploit is available.

Detection Guidance

Since this is a local path traversal vulnerability in mastergo-magic-mcp up to 0.2.0, detection requires checking for vulnerable versions and testing the affected function. Inspect installed packages for mastergo-magic-mcp versions <= 0.2.0. Test the execute function with crafted filePath arguments to observe path traversal behavior.

Impact Analysis

An attacker with local access could read sensitive files on the system by exploiting this path traversal. This may lead to unauthorized data exposure, system compromise, or further attacks depending on the accessed files.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal data or protected health information. Organizations may face penalties for failing to protect sensitive data under these regulations.

Mitigation Strategies

Immediately update mastergo-magic-mcp to a version beyond 0.2.0 if available. If no update exists, disable or uninstall the component. Restrict local access to the system and monitor for suspicious activity. Apply principle of least privilege to limit potential impact.

Hi! I’m here to help you understand CVE-2026-15749. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70