CVE-2026-19371

Name of the Vulnerable Software and Affected Versions Nikolaibibo claude-comfyui-mcp version 1.0.0

Description A path traversal issue exists in the comfy upload image component within the src/tools/utils.ts file. The copyFileSync() function does not properly validate the image path argument, allowing a local attacker to access or manipulate files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations As a temporary workaround, restrict the use of the copyFileSync() function in the comfy upload image component until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.