CVE-2026-116045

1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal

View on CVE.org
Published Oct 25, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as c8c2951dcbed9b1710a745993f028317f10a3f10. Applying a patch is advised to resolve this issue.

Analysis

AI-generated

Technical impact

A flaw in the get_reference function of 1999AZZAR designer-mcp allows an attacker to manipulate the Name argument and escape the intended directory boundaries, enabling a remote path traversal. This can expose arbitrary files on the host, potentially revealing configuration data, credentials, or other sensitive information. The weakness is identified as CWE‑22.

Affected Systems

The vulnerability affects all versions of the 1999AZZAR designer-mcp product up to and including 2.1.0. Since the project deploys rolling releases, a specific patched version is not documented, but the fixed state is reflected in the commit c8c2951dcbed9b1710a745993f028317f10a3f10.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is exploitable over the network with a publicly available exploit. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog; however, the remote nature of the attack vector increases the risk of abuse in an exposed environment.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch matching commit hash c8c2951dcbed9b1710a745993f028317f10a3f10 to all affected deployments.
  • Restrict network access to the MCP Interface’s get_reference endpoint, limiting exposure to trusted administrators or internal services.
  • Monitor logs for anomalous file access patterns or repeated attempts to request unexpected file paths, and generate alerts for potential exploitation attempts.

Generated by OpenCVE AI on October 25, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as c8c2951dcbed9b1710a745993f028317f10a3f10. Applying a patch is advised to resolve this issue.
Title 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal
First Time appeared 1999azzar
1999azzar designer-mcp
Weaknesses CWE-22
CPEs cpe:2.3:a:1999azzar:designer-mcp:*:*:*:*:*:*:*:*
Vendors & Products 1999azzar
1999azzar designer-mcp
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 3:38 PM
Reserved
Oct 24, 2026, 1:51 PM

View source JSON

Updated
Oct 29, 2026, 3:38 PM

JSON

Status
Deferred
Published
Oct 25, 2026, 7:16 AM
Modified
Oct 29, 2026, 4:18 PM

View source JSON

No data.

Updated
Oct 26, 2026, 6:52 PM

JSON