CVE-2026-19366
Received Received - Intake

Path Traversal in NocteDefensor LudusMCP

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insert_creds_range_config. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricted to local execution. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19366
EUVD
EUVD-2026-54948

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
noctedefensor ludusmcp to 1.0.24 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in NocteDefensor LudusMCP up to version 1.0.24. It exists in the insert_creds_range_config tool where the configPath and outputPath parameters are not properly validated. This allows an attacker to manipulate these paths to read or write files outside the intended directory, such as accessing sensitive system files or writing to arbitrary locations on the system.

Detection Guidance

Check for unusual file reads or writes in the LudusMCP server logs, particularly operations involving the insert_creds_range_config tool. Look for paths outside the intended ~/.ludus-mcp/range-config-templates directory. Review client commands sent to the MCP server for suspicious configPath or outputPath parameters.

Impact Analysis

The impact includes potential unauthorized file access or modification on the system running LudusMCP. An attacker could read sensitive files like configuration files or write malicious files to critical locations. Since the attack is restricted to local execution, it requires the attacker to have access to the local system where LudusMCP is running.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to sensitive files through path traversal. If exploited, it may enable reading or writing of files outside intended directories, risking exposure of personal or protected health information stored on the system.

Mitigation Strategies

Disable the insert_creds_range_config tool if not essential. Update to a patched version once available. Implement strict path validation for configPath and outputPath parameters to ensure they resolve within ~/.ludus-mcp/range-config-templates. Restrict server permissions to limit file access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart