CVE-2026-19336
Received Received - Intake

Path Traversal in spec-workflow-mcp

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access. Upgrading to version 2.2.7 is capable of addressing this issue. The patch is named 9c7a7839e690bb4543f0e7481b5740d23808e5fe. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19336
EUVD
EUVD-2026-54886

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pimzino spec-workflow-mcp 2.2.7
pimzino spec-workflow-mcp to 2.2.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the Pimzino spec-workflow-mcp tool up to version 2.2.6. It affects the ApprovalStorage.createApproval function in src/tools/approvals.ts. The flaw allows attackers with local access to manipulate the categoryName argument to write files outside the intended .spec-workflow/approvals directory by using directory traversal sequences like .. or /.

Detection Guidance

To detect this vulnerability, check for unauthorized file writes outside the intended .spec-workflow/approvals directory. Review logs for suspicious categoryName values containing path traversal sequences like .., /, or \. Inspect file system changes in directories outside the project folder.

Impact Analysis

An attacker could exploit this to write arbitrary files to unintended locations on the system, such as the temporary directory. This could lead to unauthorized file creation, potential denial of service, or compromise of sensitive data if files are written to critical system paths.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a local path traversal issue in a development tool. However, if exploited, it could allow unauthorized file writes on a system, potentially compromising data integrity or confidentiality depending on the system's role. Compliance impact would depend on the specific environment and data involved.

Mitigation Strategies

Upgrade spec-workflow-mcp to version 2.2.7 or later. Verify the patch 9c7a7839e690bb4543f0e7481b5740d23808e5fe is applied. Ensure categoryName inputs are validated to reject path traversal sequences. Monitor file system writes to detect any unauthorized activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19336. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart