CVE-2026-19285
Received Received - Intake

Path Traversal in Memory-Graph Tool

Publication date: 2026-08-08

Last updated on: 2026-08-08

Assigner: VulDB

Description
A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c. Affected by this vulnerability is the function JsonMemoryStorage.createDomain/JsonMemoryStorage.getMemories/JsonMemoryStorage.saveMemories of the file src/tools/memoryTools.ts. The manipulation results in path traversal. The attack must be initiated from a local position. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-08
Last Modified
2026-08-08
Generated
2026-08-08
AI Q&A
2026-08-08
EPSS Evaluated
N/A
NVD
CVE-2026-19285
EUVD
EUVD-2026-54785

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
aaronsb memory-graph to 1.1.0 (inc)
aaronsb memory-graph to 5cfd2382778837b9f6399080956eee670d00452c (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in the aaronsb memory-graph project. It occurs because user-controlled input in the domain ID parameter is used directly to construct file paths without proper validation. Attackers can include path traversal sequences like ../ to access or modify files outside the intended memories directory. The vulnerability affects functions such as createDomain, getMemories, and saveMemories.

Detection Guidance

To detect this path traversal vulnerability, inspect the memory-graph application for domain IDs containing path traversal sequences like '../' or absolute paths. Check logs for file operations outside the intended memoriesDir directory. Review the createDomain, getMemories, and saveMemories functions in src/tools/memoryTools.ts for improper path handling.

Impact Analysis

An attacker with local access could exploit this to read sensitive files, overwrite existing files, or create new files in unintended locations on your system. This could lead to data leakage, corruption of memory files, or execution of malicious code if the attacker places harmful files in sensitive directories.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. It may result in data breaches, non-compliance penalties, and loss of trust in systems handling personal or health data.

Mitigation Strategies

Immediately update to the latest version of memory-graph if a patch is available. If not, restrict domain IDs to alphanumeric characters only and reject any input containing path separators or traversal sequences. Ensure all file paths are resolved and validated to remain within the memoriesDir directory before any file operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart