Description
A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component upload_image. Performing a manipulation of the argument image_path results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.5.1 is sufficient to fix this issue. The patch is named 7f9a215e03575c650d38c8f87fc6d8d363fed80d. Upgrading the affected component is advised.
Published: 2026-08-28
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the fs.readFileSync call within the upload_image route of iswalle:getnote-mcp, allowing an attacker to manipulate the image_path argument to traverse directories relative to the application root. This path traversal flaw permits remote access to arbitrary files on the server outside the intended upload directory, potentially exposing sensitive data. The weakness is classified as CWE‑22, reflecting improper handling of file paths.

Affected Systems

iswalle:getnote-mcp versions up to and including 1.5.0 are affected. The vulnerability is fixed in release 1.5.1. The component is hosted on GitHub at https://github.com/iswalle/getnote-mcp/ and the patch can be identified by commit 7f9a215e03575c650d38c8f87fc6d8d363fed80d.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the public exploit is available and can be executed remotely by supplying a crafted image_path value. An attacker could read arbitrary files or leak credentials, but there is no evidence of privilege escalation or code execution. The risk is primarily limited to confidentiality and should be addressed promptly.

Generated by OpenCVE AI on August 28, 2026 at 13:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to version 1.5.1 or later, which includes the committed patch mitigating the path traversal flaw.
  • If the upgrade cannot be performed immediately, consider disabling or restricting the upload_image endpoint to prevent external access to the vulnerable route.
  • Implement server‑side validation that rejects image_path values containing directory traversal sequences such as '..', ensuring all filesystem access is confined to the intended upload directory.

Generated by OpenCVE AI on August 28, 2026 at 13:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component upload_image. Performing a manipulation of the argument image_path results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.5.1 is sufficient to fix this issue. The patch is named 7f9a215e03575c650d38c8f87fc6d8d363fed80d. Upgrading the affected component is advised.
Title iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal
First Time appeared Iswalle
Iswalle getnote-mcp
Weaknesses CWE-22
CPEs cpe:2.3:a:iswalle:getnote-mcp:*:*:*:*:*:*:*:*
Vendors & Products Iswalle
Iswalle getnote-mcp
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Iswalle Getnote-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-28T11:00:11.287Z

Reserved: 2026-08-28T05:20:18.388Z

Link: CVE-2026-82111

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T12:16:32.623

Modified: 2026-08-28T12:16:32.623

Link: CVE-2026-82111

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T13:15:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')