CVE-2026-19370

Received Received - Intake

Path Traversal in new-mcp via sessionPath Argument

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description

A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires local access. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-09

Last Modified

2026-08-09

Generated

2026-08-10

AI Q&A

2026-08-10

EPSS Evaluated

N/A

NVD

CVE-2026-19370

Affected Vendors & Products

Vendor	Product	Version / Range
bartekke8it56w2	new-mcp	0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the bartekke8it56w2 new-mcp 0.1.0 component, specifically in the file index.ts. It affects functions like fs.writeFileSync, fs.existsSync, and fs.readFileSync. The flaw allows manipulation of arguments sessionCommand or sessionPath to traverse outside intended directories.

Detection Guidance

Since this vulnerability involves path traversal in the geminithinking component of new-mcp 0.1.0, check for unusual file access patterns or attempts to read/write outside intended directories. Review logs for fs.writeFileSync, fs.existsSync, or fs.readFileSync calls with suspicious sessionCommand or sessionPath arguments.

Impact Analysis

The vulnerability requires local access to exploit. An attacker could read or write files outside the intended directory, potentially accessing sensitive data or modifying system files. This could lead to data breaches or system compromise.

Compliance Impact

This vulnerability allows path traversal through manipulation of sessionCommand/sessionPath arguments, which could lead to unauthorized file access. While not explicitly detailed, such flaws may violate data integrity and confidentiality requirements in GDPR and HIPAA if sensitive files are exposed.

Mitigation Strategies

Immediately update or patch the new-mcp component to a version that fixes the path traversal issue. If no patch is available, restrict local access to the system and monitor for suspicious activity. Consider disabling the geminithinking component if not essential.

Hi! I’m here to help you understand CVE-2026-19370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70