CVE-2026-19038
Received Received - Intake

Path Traversal in la-forge-mcp

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description
A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.ts of the component screenshot_element Tool. Such manipulation of the argument output_name leads to path traversal. The attack can be executed remotely. Upgrading to version 1.1.1 is capable of addressing this issue. The name of the patch is 1102172c9adec4a619e241efd6bfb74f5b1f4332. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-19038
EUVD
EUVD-2026-53873

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
monomythdevelopment la-forge-mcp 1.0.0
monomythdevelopment la-forge-mcp 1.1.1
monomythdevelopment la-forge-mcp to 1.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the MonomythDevelopment la-forge-mcp 1.0.0 tool. The function screenshotElement in src/index.ts writes files using the output_name parameter without proper sanitization. Attackers can manipulate this parameter to include path traversal sequences like x/../../foo, causing files to be written outside the intended directory. The fix involves applying the existing sanitizeName() function and adding a defense-in-depth helper to ensure file paths remain within the reference directory.

Detection Guidance

To detect this vulnerability, check if la-forge-mcp version 1.0.0 is installed. Inspect the src/index.ts file for the screenshotElement function and verify if output_name is sanitized. Look for unexpected file writes outside the REF_DIR directory.

Impact Analysis

An attacker who can invoke the screenshot_element tool could write arbitrary PNG files to any location on the filesystem where the application has write permissions. This could lead to file corruption, unauthorized data access, or denial-of-service conditions. The impact is limited by filesystem permissions and the fixed element_ prefix and .png suffix in filenames.

Mitigation Strategies

Upgrade la-forge-mcp to version 1.1.1 or later. Apply the patch from commit 1102172c9adec4a619e241efd6bfb74f5b1f4332 which sanitizes output_name and ensures path containment within REF_DIR.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart