CVE-2026-19365: image-gen-mcp Path Traversal Vulnerability

CVE-2026-19365 Overview

CVE-2026-19365 is a path traversal vulnerability [CWE-22] in Ichigo3766 image-gen-mcp version 0.1.0. The flaw resides in an unknown function within src/index.ts in the upscale_images component. Attackers can manipulate the output_path argument to write files outside the intended directory. Exploitation requires local access with low privileges. The project maintainer was notified via a public issue report but has not responded at the time of disclosure.

Critical Impact
A local, authenticated attacker can traverse the file system through the output_path parameter of upscale_images, potentially writing generated image data to arbitrary locations accessible to the running process.

Affected Products

Ichigo3766 image-gen-mcp version 0.1.0
Component: upscale_images in src/index.ts
No vendor patch is currently available

Discovery Timeline

2026-08-09 - CVE-2026-19365 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19365

Vulnerability Analysis

The vulnerability affects the upscale_images functionality exposed by the image-gen-mcp Model Context Protocol (MCP) server. The server accepts an output_path argument that dictates where the upscaled image is written. Because the code does not normalize or constrain this path, an attacker supplying traversal sequences such as ../ can direct writes outside the intended output directory.

The attack surface is local: the caller must already interact with the MCP server and hold low privileges (PR:L). Confidentiality, integrity, and availability effects are each rated low, reflecting the constrained scope of a single user context. The EPSS data indicates a very low near-term exploitation likelihood, consistent with the local attack vector and limited install base.

Root Cause

The root cause is missing input validation and path canonicalization on the output_path argument before it is passed to file-write operations. Without checks that resolve the path and compare it against an allowlisted base directory, traversal sequences are honored as-is by the underlying filesystem APIs. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) issue.

Attack Vector

An attacker with local access to the MCP client or host invokes the upscale_images tool and supplies an output_path such as ../../etc/attacker-controlled-file. The server writes the generated image bytes to the resolved target. Depending on the privileges of the user running the MCP server, this can overwrite user configuration files, drop files into startup or autoload locations, or corrupt application data. No verified public exploit code is available; see the GitHub Issue Discussion and VulDB CVE-2026-19365 for technical context.

Detection Methods for CVE-2026-19365

Indicators of Compromise

Files written by the image-gen-mcp process outside its configured output directory, particularly image files (PNG, JPEG) landing in user home directories, config paths, or startup locations.
Log or telemetry entries showing upscale_images invocations where the output_path argument contains .., absolute paths, or URL-encoded traversal sequences.
Unexpected modification timestamps on sensitive user files coinciding with MCP server activity.

Detection Strategies

Instrument the MCP server or its wrapper to log every output_path value passed to upscale_images and alert on paths containing traversal patterns or resolving outside the intended base directory.
Apply endpoint file integrity monitoring to directories that should not receive writes from the Node.js process hosting image-gen-mcp.
Correlate process-level file writes with the parent MCP process to identify anomalous output destinations.

Monitoring Recommendations

Enable audit logging (for example, Linux auditdpath rules or Windows object access auditing) on directories adjacent to the MCP output path.
Track child process and file-write activity for the Node.js runtime executing src/index.ts.
Review MCP client logs for tool-call arguments and flag suspicious output_path values during code review or SOC triage.

How to Mitigate CVE-2026-19365

Immediate Actions Required

Stop exposing the upscale_images tool from image-gen-mcp0.1.0 to untrusted local users or automations until a fix is available.
Run the MCP server under a dedicated low-privilege user account with write access limited to a single, non-sensitive output directory.
Wrap or fork the server to validate that output_path resolves to a canonical path inside an allowlisted base directory before any file write.

Patch Information

No vendor patch is currently available. The maintainer was notified through the GitHub Issue Discussion but has not responded. Track the GitHub Project Repository for updates and rebuild from source once a fix lands.

Workarounds

Enforce a chroot, container, or filesystem sandbox that constrains the MCP server's writable paths to a single directory.
Add a validation layer that rejects output_path values containing .., absolute paths, symbolic links, or characters outside an expected set before invoking upscale_images.
Use mandatory access controls (AppArmor, SELinux) to restrict the Node.js process to an explicit write-allowed directory.

bash

# Example: restrict the MCP server to a single output directory with AppArmor
# /etc/apparmor.d/image-gen-mcp
#include <tunables/global>
profile image-gen-mcp /usr/bin/node {
  #include <abstractions/base>
  /opt/image-gen-mcp/** r,
  /var/lib/image-gen-mcp/output/** rw,
  deny /** w,
}