Description
A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access. Upgrading to version 2.2.7 is capable of addressing this issue. The patch is named 9c7a7839e690bb4543f0e7481b5740d23808e5fe. It is advisable to upgrade the affected component.
Published: 2026-08-09
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A path‑traversal flaw exists in the ApprovalStorage.createApproval function of Pimzino spec-workflow-mcp when the categoryName argument is manipulated. The vulnerability allows a local user to cause the application to reference arbitrary file system paths, potentially enabling reading or writing of files outside the intended directory.

Affected Systems

Pimzino spec-workflow-mcp versions up to 2.2.6 are affected. Version 2.2.7 contains the fix that prevents the path traversal by validating the categoryName input.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. The EPSS value is not provided and the issue is not listed in the CISA KEV catalog. The attack requires local access, meaning an attacker must already have some level of privilege on the host to exploit the flaw. Once local access is achieved, the path traversal could be used to reach arbitrary files on the system, impacting confidentiality and integrity of the file system.

Generated by OpenCVE AI on August 9, 2026 at 07:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the upgrade to version 2.2.7, which incorporates the patch identified by commit 9c7a7839e690bb4543f0e7481b5740d23808e5fe.
  • Restrict local execution privileges or sandbox the component to reduce the ability of users or processes to invoke ApprovalStorage.createApproval with malicious input.
  • If immediate upgrade is not possible, temporarily disable the ApprovalStorage.createApproval endpoint or enforce strict whitelist checks on the categoryName parameter to prevent directory traversal attempts.

Generated by OpenCVE AI on August 9, 2026 at 07:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 09 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access. Upgrading to version 2.2.7 is capable of addressing this issue. The patch is named 9c7a7839e690bb4543f0e7481b5740d23808e5fe. It is advisable to upgrade the affected component.
Title Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal
First Time appeared Pimzino
Pimzino spec-workflow-mcp
Weaknesses CWE-22
CPEs cpe:2.3:a:pimzino:spec-workflow-mcp:*:*:*:*:*:*:*:*
Vendors & Products Pimzino
Pimzino spec-workflow-mcp
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Pimzino Spec-workflow-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-09T05:30:11.611Z

Reserved: 2026-08-08T09:55:36.553Z

Link: CVE-2026-19336

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-09T07:30:04Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')