Description
A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcp__getComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-14
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The mastergo-design mastergo-magic-mcp component mcp__getComponentGenerator contains a path traversal flaw in the execute function of component-workflow.md. Manipulation of the rootPath argument can cause the application to traverse directories outside the intended location, potentially allowing an attacker to read or list files on the underlying file system. This vulnerability is limited to the local execution context and does not provide direct network exposure. The same weakness is identified by CWE-22.

Affected Systems

The affected product is mastergo-design mastergo-magic-mcp, specifically all releases up to and including version 0.2.0. No fixed version is indicated in the advisory; users should verify whether newer releases have been published since the vulnerability was disclosed.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate impact. The EPSS score of less than 1 % shows a very low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The attack can only be carried out locally, so the risk is further confined to environments where a user can run the application or has local file write access.

Generated by OpenCVE AI on July 31, 2026 at 04:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade mastergo-magic-mcp to a version newer than 0.2.0 once a patch is available.
  • If no patch exists, enforce strict file path validation on the rootPath input or disable the execute functionality that accepts arbitrary paths.
  • Implement least‑privilege for the user running the application and regularly audit file access logs for suspicious path traversal attempts.

Generated by OpenCVE AI on July 31, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 16 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcp__getComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal
First Time appeared Mastergo-design
Mastergo-design mastergo-magic-mcp
Weaknesses CWE-22
CPEs cpe:2.3:a:mastergo-design:mastergo-magic-mcp:*:*:*:*:*:*:*:*
Vendors & Products Mastergo-design
Mastergo-design mastergo-magic-mcp
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mastergo-design Mastergo-magic-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-15T14:55:35.799Z

Reserved: 2026-07-14T15:39:51.050Z

Link: CVE-2026-15751

cve-icon Vulnrichment

Updated: 2026-07-15T14:55:29.573Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:30:03Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')