CVE-2026-19372

Name of the Vulnerable Software and Affected Versions Handwriting-OCR handwriting-ocr-mcp-server version 0.1.0

Description A path traversal flaw exists in the upload document component within the src/index.ts file. The issue occurs in the fs.readFileSync() function when the File argument is manipulated, allowing a local attacker to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations As a temporary workaround, restrict the use of the File argument in the fs.readFileSync() function within the upload document component until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.