CVE-2026-19270 Overview
CVE-2026-19270 is a path traversal vulnerability [CWE-22] affecting Hulupeep mcp-ui-probe versions up to 0.2.0. The flaw resides in the get_journey, delete_journey, analyze_journey, and usage_stats functions within src/journey/JourneyStorage.ts. Attackers with local access can manipulate the journeyId and filename arguments to traverse outside intended storage directories. The maintainers received an early issue report but have not responded at the time of publication.
Critical Impact
A local authenticated attacker can read, delete, or analyze arbitrary files accessible to the running process by supplying crafted path components to journey-handling functions.
Affected Products
- Hulupeep mcp-ui-probe versions up to and including 0.2.0
- Components: Journey/Usage handlers in src/journey/JourneyStorage.ts
- Deployments exposing journey APIs to local users
Discovery Timeline
- 2026-08-08 - CVE-2026-19270 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19270
Vulnerability Analysis
The vulnerability stems from insufficient sanitization of user-controlled path components in journey storage handlers. The functions get_journey, delete_journey, analyze_journey, and usage_stats accept a journeyId or filename argument. These values are concatenated into filesystem paths without normalization or containment checks. An attacker can inject sequences such as ../ to escape the intended journey directory. This yields unauthorized read, delete, or analysis operations against files reachable by the process user.
The issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Exploitation requires local access and low-privileged authentication. No public exploit is currently known, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The JourneyStorage.ts module trusts caller-supplied identifiers as safe filename fragments. Because there is no allowlist validation, canonical path resolution check, or rejection of directory separators, any relative traversal sequence resolves to a file outside the storage root.
Attack Vector
An attacker interacting locally with the Model Context Protocol (MCP) probe passes a crafted journeyId such as ../../etc/hostname to a vulnerable handler. The storage layer opens the resolved path, returning contents or performing deletion. See the GitHub PoC Repository and the GitHub Issue Tracker for technical context.
// No verified exploit code is publicly available.
// Refer to the linked issue tracker for technical details.
Detection Methods for CVE-2026-19270
Indicators of Compromise
- Journey identifiers or filename arguments containing ../, ..\\, URL-encoded traversal sequences, or absolute paths
- Access logs showing get_journey, delete_journey, analyze_journey, or usage_stats calls resolving to files outside the journey storage directory
- Unexpected file reads or deletions performed by the mcp-ui-probe process user
Detection Strategies
- Instrument JourneyStorage.ts handlers to log every resolved path and flag any path that escapes the configured journey root
- Monitor process-level file operations of the mcp-ui-probe runtime for reads outside its data directory
- Apply static analysis rules against the codebase to identify path concatenation without path.resolve boundary checks
Monitoring Recommendations
- Forward filesystem audit events from hosts running mcp-ui-probe to a centralized data lake for correlation
- Alert on deletion of files outside the expected journey storage path
- Track invocation frequency of journey APIs by non-service local accounts
How to Mitigate CVE-2026-19270
Immediate Actions Required
- Restrict local access to systems running mcp-ui-probe to trusted administrators only
- Disable or firewall exposed journey endpoints until a fix is released
- Run the mcp-ui-probe process under a dedicated low-privilege account with a constrained working directory
Patch Information
No vendor patch is available at the time of publication. The maintainer has not responded to the disclosure filed via the GitHub Issue Tracker. Track the VulDB CVE Entry for updates.
Workarounds
- Fork the project and add validation that rejects journeyId or filename values containing /, \\, .., or null bytes
- Resolve the final path with path.resolve and confirm it begins with the canonical journey storage directory before any I/O
- Apply operating-system level mandatory access controls such as AppArmor or SELinux to confine the process to its data directory
# Example containment using systemd unit hardening
# /etc/systemd/system/mcp-ui-probe.service.d/override.conf
[Service]
ReadWritePaths=/var/lib/mcp-ui-probe/journeys
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
