CVE-2026-19046

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP versions prior to 1.0.25

Description A path traversal issue exists within the ludus environment guides search component, specifically in a function located in the src/tools/ludusEnvironmentGuidesSearch.ts file. This occurs when the guide name argument is manipulated, allowing an attacker with local access to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the guide name argument in the ludus environment guides search component to minimize the risk of exploitation.