CVE-2026-19270
Received Received - Intake

Path Traversal in Hulupeep mcp-ui-probe

Publication date: 2026-08-08

Last updated on: 2026-08-08

Assigner: VulDB

Description
A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path traversal. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-08
Last Modified
2026-08-08
Generated
2026-08-08
AI Q&A
2026-08-08
EPSS Evaluated
N/A
NVD
CVE-2026-19270
EUVD
EUVD-2026-54769

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hulupeep mcp-ui-probe to 0.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19270 is a path traversal vulnerability in Hulupeep mcp-ui-probe up to version 0.2.0. It affects functions like get_journey, delete_journey, analyze_journey, and usage_stats in the JourneyStorage.ts file. The flaw allows manipulation of path arguments like journeyId or filename to escape intended directories, enabling unauthorized file access, deletion, or modification outside designated storage areas.

Detection Guidance

Check for suspicious file operations in the Hulupeep mcp-ui-probe logs, particularly around journeyId/filename handling. Look for paths containing ../ or absolute paths in requests to get_journey/delete_journey/analyze_journey/usage_stats endpoints. Review filesystem access patterns outside the expected directories.

Impact Analysis

This vulnerability could allow attackers to read, delete, or write files outside intended directories. This may lead to exposure of sensitive data, system file manipulation, or unauthorized file creation. Since the attack requires local access, it primarily affects users who have installed the vulnerable software on their systems.

Compliance Impact

This vulnerability could lead to unauthorized access, modification, or deletion of sensitive files outside intended directories. For GDPR, this may result in unauthorized processing of personal data, violating principles of lawfulness and data minimization. For HIPAA, it could expose protected health information (PHI) to unauthorized parties, violating integrity and confidentiality requirements.

Mitigation Strategies

Immediately update to the latest version of Hulupeep mcp-ui-probe if available. If not, restrict filesystem access permissions for the application user. Implement input validation to reject path traversal sequences (../), absolute paths, and drive-prefixed paths. Ensure resolved paths stay within intended base directories before file operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart