CVE-2026-15751: MasterGo MCP Path Traversal Vulnerability

CVE-2026-15751 Overview

CVE-2026-15751 is a path traversal vulnerability [CWE-22] affecting mastergo-design mastergo-magic-mcp versions up to 0.2.0. The flaw resides in the execute function within mastergo/component-workflow.md, part of the mcp__getComponentGenerator component. An attacker with local access can manipulate the rootPath argument to traverse directories outside the intended scope. The exploit has been publicly disclosed, though no active exploitation has been reported. The project maintainers were notified through a GitHub issue but have not yet responded.

Critical Impact
Local attackers can leverage unsanitized rootPath input to read or write files outside the intended working directory, potentially exposing sensitive files or corrupting project resources.

Affected Products

mastergo-design mastergo-magic-mcp versions up to 0.2.0
Component: mcp__getComponentGenerator
File: mastergo/component-workflow.md

Discovery Timeline

2026-07-14 - CVE CVE-2026-15751 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15751

Vulnerability Analysis

The vulnerability exists in the execute function of the component workflow handler within the Model Context Protocol (MCP) server implementation. The mcp__getComponentGenerator component accepts a rootPath argument that specifies where generated component files should be written. The function fails to validate or canonicalize this input before using it in file system operations.

An attacker supplying path traversal sequences such as ../ can escape the intended output directory. This enables reading from or writing to arbitrary locations accessible to the process user. The attack requires local access with low privileges and no user interaction.

Root Cause

The root cause is missing input sanitization on the rootPath parameter passed to the execute function. The code does not enforce a boundary check to ensure the resolved path stays within an approved base directory. Path canonicalization and allow-list validation are absent from the workflow handler.

Attack Vector

Exploitation requires local access to a system running the vulnerable MCP server. An attacker invokes the mcp__getComponentGenerator tool through the MCP interface with a crafted rootPath containing directory traversal sequences. The server then performs file operations at the attacker-controlled location. Because MCP servers frequently run under user privileges alongside AI agents, the impact scope depends on the invoking user's permissions.

No verified proof-of-concept code has been published. See the GitHub Issue Tracker Entry for additional technical context.

Detection Methods for CVE-2026-15751

Indicators of Compromise

Unexpected file creation or modification outside the configured component output directory.
MCP request logs containing rootPath arguments with ../ or absolute path prefixes.
New or altered files in sensitive directories such as user home folders, SSH configuration paths, or startup script locations.

Detection Strategies

Inspect MCP server request logs for rootPath parameters containing traversal sequences or absolute paths.
Monitor process activity of mastergo-magic-mcp for file writes outside its expected working directory.
Enable file integrity monitoring on directories adjacent to and above the MCP server's project root.

Monitoring Recommendations

Log all invocations of mcp__getComponentGenerator including full argument payloads.
Alert on any file system syscall from the MCP process targeting paths outside the sanctioned project directory.
Review GitHub project activity for upstream patches or advisory updates on issue #90.

How to Mitigate CVE-2026-15751

Immediate Actions Required

Restrict access to the local system running mastergo-magic-mcp to trusted users only.
Run the MCP server under a least-privilege account with no write access to sensitive directories.
Disable or unregister the mcp__getComponentGenerator tool if it is not required in your workflow.

Patch Information

At the time of publication, no vendor patch is available. The maintainers of mastergo-design/mastergo-magic-mcp have been notified via the GitHub Issue Tracker Entry but have not responded. Track the GitHub Project Repository for release updates addressing the rootPath validation issue.

Workarounds

Wrap invocations of the component generator with a validator that rejects rootPath values containing .., absolute path prefixes, or symbolic link segments.
Execute the MCP server inside a container or sandbox with read-only bind mounts for directories outside the project scope.
Use mandatory access controls such as AppArmor or SELinux to confine file system writes to the intended project directory.

bash

# Example: run mastergo-magic-mcp inside a restricted container
docker run --rm \
  --user 1000:1000 \
  --read-only \
  --tmpfs /tmp \
  -v "$(pwd)/project":/workspace:rw \
  --workdir /workspace \
  mastergo-magic-mcp:latest