Cccccccti

**Name of the Vulnerable Software and Affected Versions** danielpopamd linkedin-ads-mcp version 1.0.0 **Description** A path traversal issue exists in the Media Upload component. This occurs when the `filePath` argument passed to the `fs.readFileSync()` function in the `src/tools/campaign-management.ts` file is not properly validated, allowing a remote attacker to access files outside the intended directory. **Recommendations** As a temporary workaround, restrict the use of the `fs.readFileSync()` function within the Media Upload component until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** blackms aistack versions prior to 1.6.2 **Description** A path traversal issue exists in the Static File Handler component within the file src/web/server.ts. A remote attacker can manipulate the `req.url` argument to access files and directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** boxpositron with-context-mcp versions prior to 3.0.8 **Description** A flaw in the `ingest notes/teleport notes/sync notes/project folder` function within the `src/index.ts` file allows for remote path traversal. Path traversal is a condition where an attacker can access files and directories that are stored outside the web root folder by manipulating variables that control a file path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `ingest notes/teleport notes/sync notes/project folder` function.

**Name of the Vulnerable Software and Affected Versions** bsmi021 mcp-file-context-server version 1.0.0 **Description** A path traversal issue exists in the Path Resolution component. A remote attacker can manipulate the `path` argument within the `read context()` function located in the `src/index.ts` file to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated. **Recommendations** As a temporary workaround, restrict the use of the `read context()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ddfourtwo sentry-selfhosted-mcp version 0.4.0 **Description** A flaw in the `raw sentry api` component allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This is achieved by manipulating the `endpoint` argument within an unknown function, enabling remote attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `raw sentry api` component or avoid using the `endpoint` argument until a patch is released.

**Name of the Vulnerable Software and Affected Versions** dekdee adobe-xd-mcp version 1.0.0 **Description** A path traversal issue exists in the `file-access-from-request` endpoint within the `src/parsers/xd-parser.ts` file. A remote attacker can exploit this by manipulating the `outputFile` or `outputDir` arguments, potentially allowing unauthorized access to files or directories outside the intended path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `outputFile` and `outputDir` arguments in the `file-access-from-request` endpoint until the issue is resolved.

A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this vulnerability is the function LocalFileServiceImpl.uploadPictureByUrl of the file mogu picture/src/main/java/com/moxi/mogublog/picture/service/impl/LocalFileServiceImpl.java of the component Picture Storage Service. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0. The affected element is the function Upload of the file FileTool.java of the component File Upload Endpoint. The manipulation of the argument Type results in path traversal. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Name of the Vulnerable Software and Affected Versions HummerRisk versions up to 1.5.0 Description A server-side request forgery exists in the Video File Download URL Handler component. Manipulation of the `streamIp` argument in the `ServerService.addServer()` function within the `ServerService.java` file allows a remote attacker to perform this action. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.