CVE-2026-19371
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Aug 09, 2026
Vendor
unknown
Description
A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfy_upload_image. Such manipulation of the argument image_path leads to path traversal. An attack has to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.