CVE-2026-19372

Received Received - Intake

Path Traversal in Handwriting-OCR MCP Server

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component upload_document. Performing a manipulation of the argument File results in path traversal. Attacking locally is a requirement. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-09

Last Modified

2026-08-09

Generated

2026-08-10

AI Q&A

2026-08-10

EPSS Evaluated

N/A

NVD

CVE-2026-19372

EUVD

EUVD-2026-54959

Affected Vendors & Products

Vendor	Product	Version / Range
handwriting-ocr	handwriting-ocr-mcp-server	0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal flaw in the Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. It exists in the fs.readFileSync function within the src/index.ts file, specifically in the upload_document component. An attacker can manipulate the File argument to perform path traversal, potentially accessing unauthorized files on the system.

Detection Guidance

Since this vulnerability involves path traversal via the fs.readFileSync function in the upload_document component, check for unusual file access patterns or requests containing path traversal sequences like ../ in the File argument. Monitor logs for unexpected file reads outside intended directories.

Impact Analysis

If you use Handwriting-OCR handwriting-ocr-mcp-server 0.1.0, an attacker with local access could exploit this to read sensitive files outside intended directories. This may lead to unauthorized data exposure or system compromise, depending on file permissions.

Compliance Impact

The vulnerability allows path traversal through manipulation of the File argument in fs.readFileSync, which could lead to unauthorized access to sensitive files. This may impact compliance with GDPR by risking exposure of personal data and HIPAA by potentially exposing protected health information if such files are accessed.

Mitigation Strategies

Immediately update or patch the handwriting-ocr-mcp-server to a version that fixes the path traversal issue in fs.readFileSync. If no patch is available, disable the upload_document component or restrict file access to trusted directories only.

Hi! I’m here to help you understand CVE-2026-19372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70