Description
Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server
Published: 2026-07-21
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A directory traversal flaw exists in the DayuanJiang next‑ai‑draw‑io package version 0.4.13, allowing a remote attacker to supply crafted paths to the mcp‑server endpoint and trigger execution of arbitrary code. The weakness is a CWE‑22 directory traversal vulnerability stemming from insufficient validation of user‑supplied file paths, enabling the attacker to reach unintended files or execute malicious commands, thereby compromising the confidentiality, integrity, and availability of the host system.

Affected Systems

The vulnerability affects the DayuanJiang next‑ai‑draw‑io package at version 0.4.13. Any installation that exposes the mcp‑server endpoint to external traffic is susceptible.

Risk and Exploitability

The CVSS score of 7.8 classifies this vulnerability as high severity. With an EPSS below 1 % the likelihood of public exploitation is presently low, and it is not listed in the CISA KEV catalog. The attack vector is remote, as indicated by the ability to trigger code execution via the exposed mcp‑server endpoint.

Generated by OpenCVE AI on August 4, 2026 at 05:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the DayuanJiang next‑ai‑draw‑io package to a patched version that contains the directory traversal fix
  • If an upgrade cannot be performed immediately, disable external access to the mcp‑server component until a suitable patch is applied
  • Configure network segmentation or firewall rules to restrict inbound traffic to the mcp‑server interface

Generated by OpenCVE AI on August 4, 2026 at 05:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Title Directory Traversal in next‑ai‑draw‑io 0.4.13 Allows Remote Code Execution

Thu, 30 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Directory Traversal in next‑ai‑draw‑io 0.4.13 Allows Remote Code Execution

Wed, 29 Jul 2026 00:45:00 +0000

Type Values Removed Values Added
Title Directory Traversal Leading to Remote Code Execution in DayuanJiang next‑ai‑draw‑io

Fri, 24 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Directory Traversal Leading to Remote Code Execution in DayuanJiang next‑ai‑draw‑io

Thu, 23 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Dayuanjiang
Dayuanjiang next-ai-draw-io
Vendors & Products Dayuanjiang
Dayuanjiang next-ai-draw-io

Wed, 22 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Description Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server
References

Subscriptions

Dayuanjiang Next-ai-draw-io
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-22T17:54:22.794Z

Reserved: 2026-06-07T00:00:00.000Z

Link: CVE-2026-50757

cve-icon Vulnrichment

Updated: 2026-07-22T17:54:05.408Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T06:00:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')