CVE-2026-19371

Received Received - Intake

Path Traversal in Nikolaibibo claude-comfyui-mcp

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description

A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfy_upload_image. Such manipulation of the argument image_path leads to path traversal. An attack has to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-09

Last Modified

2026-08-09

Generated

2026-08-10

AI Q&A

2026-08-10

EPSS Evaluated

N/A

NVD

CVE-2026-19371

EUVD

EUVD-2026-54958

Affected Vendors & Products

Vendor	Product	Version / Range
nikolaibibo	claude-comfyui-mcp	1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the Nikolaibibo claude-comfyui-mcp 1.0.0 software. It exists in the copyFileSync function of src/tools/utils.ts within the comfy_upload_image component. The flaw allows manipulation of the image_path argument to traverse outside intended directories. An attacker must have local access to exploit this.

Detection Guidance

This vulnerability requires local access to exploit and involves path traversal in the claude-comfyui-mcp tool. Check for unusual file operations or unexpected file reads/writes in the comfy_upload_image component. Review logs for suspicious image_path arguments in src/tools/utils.ts.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read or write files outside the intended directory on your system. This may lead to unauthorized access to sensitive data, system files, or even execution of malicious code. Since local access is required, it primarily affects users who have direct access to the vulnerable system.

Compliance Impact

This vulnerability allows local path traversal through manipulation of the image_path argument in the copyFileSync function. While not directly impacting GDPR or HIPAA compliance, such vulnerabilities could potentially lead to unauthorized access to sensitive files if exploited, which may violate data protection requirements under these regulations.

Mitigation Strategies

Immediately update or patch the claude-comfyui-mcp tool to the latest version. Restrict local access to untrusted users. Monitor file system activity for unauthorized changes. Disable the comfy_upload_image component if not essential.

Hi! I’m here to help you understand CVE-2026-19371. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70