Gongyanyu05

**Name of the Vulnerable Software and Affected Versions** Ichigo3766 image-gen-mcp version 0.1.0 **Description** A path traversal issue exists within the `upscale images` component in the `src/index.ts` file. A local attacker can manipulate the `output path` argument to access or overwrite files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `output path` argument in the `upscale images` component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** NocteDefensor LudusMCP versions prior to 1.0.25 **Description** A path traversal flaw exists within the `insert creds range config` component, specifically in the `src/tools/insertCredsRangeConfig.ts` file. A local attacker can manipulate the `configPath` or `outputPath` arguments to access or modify files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NocteDefensor LudusMCP version 1.0.24 **Description** A server-side request forgery exists in the `read range config` component within the `src/tools/rangeConfig.ts` file. A remote attacker can trigger this issue by manipulating the `Source` argument, allowing the server to make unauthorized requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `read range config` component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PV-Bhat gemsuite-mcp version 1.0.0 **Description** A path traversal issue exists within the `gemini search/gemini reason/gemini process/gemini analyze` component, specifically in the `src/handlers/unified-gemini.ts` file. A local attacker can exploit this by manipulating the `file path` or `file paths` arguments to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KS-GEN-AI jira-mcp-server version 0.2.0 **Description** An issue exists in the `add attachment from public url` component within the `src/index.ts` file. The `axios.get()` function is susceptible to server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the manipulation of the `imageUrl` argument and requires a local approach for exploitation. **Recommendations** As a temporary workaround, restrict the use of the `imageUrl` argument within the `add attachment from public url` component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bartekke8it56w2 new-mcp version 0.1.0 **Description** A path traversal issue exists within the geminithinking component in the file index.ts. The flaw occurs when the `sessionCommand` or `sessionPath` arguments are manipulated, affecting the `fs.writeFileSync()`, `fs.existsSync()`, and `fs.readFileSync()` functions. Exploitation of this issue requires local access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nikolaibibo claude-comfyui-mcp version 1.0.0 **Description** A path traversal issue exists in the `comfy upload image` component within the `src/tools/utils.ts` file. The `copyFileSync()` function does not properly validate the `image path` argument, allowing a local attacker to access or manipulate files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** As a temporary workaround, restrict the use of the `copyFileSync()` function in the `comfy upload image` component until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Handwriting-OCR handwriting-ocr-mcp-server version 0.1.0 **Description** A path traversal flaw exists in the `upload document` component within the `src/index.ts` file. The issue occurs in the `fs.readFileSync()` function when the `File` argument is manipulated, allowing a local attacker to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** As a temporary workaround, restrict the use of the `File` argument in the `fs.readFileSync()` function within the `upload document` component until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PhialsBasement KoboldCPP-MCP-Server version 1.0.0 **Description** A server-side request forgery (SSRF) issue exists within the `BaseConfigSchema` component in the `src/index.ts` file. The flaw occurs in the `makeRequest()` function, where manipulation of the `apiUrl` variable allows an attacker to induce the server to make unauthorized requests, including attacks targeting the local host. **Recommendations** As a temporary mitigation, restrict or validate the input provided to the `apiUrl` variable used in the `makeRequest()` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** adafap api-mcp versions up to 92b9a5d04acfec165c7d4ef852496593aa87be06 **Description** A server-side request forgery issue exists in the Proxy API Endpoint component within the file app/api/proxy/route.ts. The flaw occurs in the `customAxios()` function, where improper handling of the `url` argument allows a remote attacker to induce the server to make unauthorized requests. **Recommendations** As a temporary workaround, restrict access to the `customAxios()` function in the app/api/proxy/route.ts file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.