CVE-2026-19325
Received Received - Intake

Path Traversal in IncomeStreamSurfer roo-code-memory-bank-mcp-server

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects the function readMemoryBankFile/appendMemoryBankEntry of the file src/index.ts of the component read_memory_bank_file/append_memory_bank_entry. Such manipulation of the argument file_name leads to path traversal. The attack must be carried out locally. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19325
EUVD
EUVD-2026-54852

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
incomestreamsurfer roo-code-memory-bank-mcp-server 0.1.0
incomestreamsurfer roo-code-memory-bank-mcp-server to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in the IncomeStreamSurfer roo-code-memory-bank-mcp-server. It affects the functions readMemoryBankFile and appendMemoryBankEntry in src/index.ts. The vulnerability occurs because the file_name parameter is used directly in path.join without validation, allowing attackers to use sequences like ../ to access files outside the intended memory-bank directory. This can lead to reading or modifying arbitrary files on the server system.

Detection Guidance

To detect this vulnerability, check if the IncomeStreamSurfer roo-code-memory-bank-mcp-server is running and inspect the file_name parameter handling in src/index.ts. Look for path traversal sequences like '../' in file_name inputs. Test by attempting to read or write files outside the intended memory-bank directory using the MCP tools read_memory_bank_file or append_memory_bank_entry.

Impact Analysis

An attacker with local access could exploit this to read sensitive files on the server, such as configuration files, credentials, or other confidential data. They could also modify or delete files, potentially disrupting the server's operation or injecting malicious content. Since the attack requires local access, the risk is higher for systems where untrusted users have local privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using this software may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Immediately update the roo-code-memory-bank-mcp-server to the latest version if available. If not, disable the MCP tools read_memory_bank_file and append_memory_bank_entry until a patch is released. Implement input validation to reject traversal sequences, absolute paths, and path separators in the file_name parameter. Ensure resolved paths stay within the MEMORY_BANK_PATH directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19325. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart