CVE-2026-19325: roo-code-memory-bank Path Traversal Flaw

CVE-2026-19325 Overview

CVE-2026-19325 is a path traversal vulnerability [CWE-22] in the IncomeStreamSurfer roo-code-memory-bank-mcp-server project up to commit 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. The flaw resides in the readMemoryBankFile and appendMemoryBankEntry functions within src/index.ts, which handle the read_memory_bank_file and append_memory_bank_entry operations. Manipulation of the file_name argument allows an attacker with local access and low privileges to traverse directories outside the intended memory bank path. The project uses a rolling release model, so no fixed version identifier is published. The maintainer was notified through an issue report but has not responded.

Critical Impact
A local, authenticated attacker can read or append to files outside the intended directory by supplying crafted file_name values, affecting confidentiality and integrity of files accessible to the server process.

Affected Products

IncomeStreamSurfer roo-code-memory-bank-mcp-server up to commit 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e
Component: read_memory_bank_file / append_memory_bank_entry handlers in src/index.ts
Deployment note: rolling release; no fixed version published at time of writing

Discovery Timeline

2026-08-09 - CVE-2026-19325 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in the NVD database

Technical Details for CVE-2026-19325

Vulnerability Analysis

The vulnerability lies in how the Model Context Protocol (MCP) server handles user-supplied file names. The readMemoryBankFile function accepts a file_name argument and joins it with a base memory bank directory before performing a file system read. The appendMemoryBankEntry function follows the same pattern before writing. Neither function validates that the resolved path stays within the intended directory. An attacker who can invoke these handlers can supply relative path segments such as ../ or absolute paths to escape the memory bank scope. Because the server exposes these functions to a local caller, the attack surface is bounded by whichever process on the host can reach the MCP endpoint.

Root Cause

The root cause is missing path canonicalization and containment checks on the file_name parameter [CWE-22]. The code concatenates the untrusted input with a base directory without resolving the result and verifying it starts with that base. This omission is a classic Improper Limitation of a Pathname to a Restricted Directory pattern.

Attack Vector

Exploitation requires local access to the MCP server and low-privileged authentication. The attacker sends a read_memory_bank_file request with a file_name such as ../../etc/passwd, or an append_memory_bank_entry request pointing at a sensitive configuration file. The server resolves the concatenated path and performs the file operation with the process's own privileges, exposing arbitrary readable files or corrupting arbitrary writable files.

No public proof-of-concept code is verified for this issue. Refer to the GitHub Issue Tracker and the VulDB CVE-2026-19325 entry for further technical detail.

Detection Methods for CVE-2026-19325

Indicators of Compromise

Requests to read_memory_bank_file or append_memory_bank_entry where file_name contains ../, ..\, URL-encoded traversal sequences such as %2e%2e%2f, or absolute paths
Access log entries showing the MCP server process opening files outside the configured memory bank directory
Unexpected modifications or new entries appended to files owned by the account running the MCP server

Detection Strategies

Instrument the MCP server or its host with file access auditing (for example, Linux auditd rules on the memory bank directory's parent) and alert when the server process reads or writes outside that directory
Add request-level logging that records the raw file_name parameter, then match against a regular expression covering traversal patterns
Use endpoint or workload telemetry to correlate the MCP server process ID with file operations on sensitive paths such as /etc, user home directories, or credential stores

Monitoring Recommendations

Forward MCP server application logs and host file-access logs to a centralized log platform for retention and correlation
Baseline the set of files normally touched by the MCP server and alert on deviations
Review the GitHub Project Repository for future commits addressing path handling and update detections accordingly

How to Mitigate CVE-2026-19325

Immediate Actions Required

Restrict local access to the MCP server to trusted user accounts only, since exploitation requires a local caller with low privileges
Run the server under a dedicated, unprivileged service account with file system access limited to the memory bank directory
Apply mandatory access controls (AppArmor, SELinux, or equivalent) to confine the process to its intended paths

Patch Information

No vendor patch is available at time of writing. The project follows a rolling release model, and the maintainer has not yet responded to the GitHub Issue Tracker report. Track the GitHub Project Repository for commits that add path canonicalization to readMemoryBankFile and appendMemoryBankEntry.

Workarounds

Fork the project and patch src/index.ts so both handlers resolve the joined path with path.resolve() and reject any result that does not start with the canonicalized memory bank base directory
Reject file_name values containing .., path separators, null bytes, or absolute path prefixes before the file system call
Chroot or containerize the server so that even a successful traversal cannot reach sensitive host files
Disable the read_memory_bank_file and append_memory_bank_entry handlers until a validated fix is deployed if they are not required

bash

# Example containment: run the MCP server under systemd with a restricted file system view
[Service]
User=mcp
Group=mcp
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/roo-code/memory-bank
NoNewPrivileges=yes