CVE-2026-19371: Claude-ComfyUI-MCP Path Traversal Flaw

CVE-2026-19371 Overview

CVE-2026-19371 is a path traversal vulnerability [CWE-22] in Nikolaibibo claude-comfyui-mcp version 1.0.0. The flaw resides in the copyFileSync function within src/tools/utils.ts, part of the comfy_upload_image component. An attacker with local access can manipulate the image_path argument to traverse outside the intended directory and access or copy arbitrary files. The project maintainer received an issue report about the flaw but has not responded at the time of publication. Exploitation requires local access and low privileges, and no fix is currently available from the upstream project.

Critical Impact
Local attackers can abuse the image_path parameter of the comfy_upload_image tool to read or write files outside the intended upload directory via directory traversal sequences.

Affected Products

Nikolaibibo claude-comfyui-mcp 1.0.0
Component: comfy_upload_image
File: src/tools/utils.ts (copyFileSync function)

Discovery Timeline

2026-08-09 - CVE-2026-19371 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19371

Vulnerability Analysis

The vulnerability is a classic path traversal issue in a Model Context Protocol (MCP) server that bridges Claude with ComfyUI. The comfy_upload_image tool accepts an image_path argument supplied by a client and passes it to copyFileSync in src/tools/utils.ts without normalizing or validating the resolved path. When the input contains sequences such as ../ or an absolute path, the function copies from or writes to locations outside the intended image directory.

Because the attack vector is local, a threat actor needs the ability to invoke the MCP tool, typically by controlling prompts sent to the connected Claude client or by running alongside the MCP server. The confidentiality, integrity, and availability impacts are all rated low, reflecting a scoped, single-tenant exposure rather than remote compromise.

Root Cause

The root cause is missing canonicalization and allow-list validation on the image_path parameter before it is passed to Node.js file system APIs. The copyFileSync call trusts caller-supplied input, so relative traversal sequences resolve against the current working directory rather than being confined to a designated uploads folder.

Attack Vector

An attacker with local access to the MCP client-server channel invokes the comfy_upload_image tool with an image_path value such as ../../etc/passwd or an absolute path pointing at a sensitive file. The server then copies that file into a location the attacker controls or overwrites files the process can write. Exploitation is described in the public issue tracker for the repository.

The vulnerability is described in prose only; no verified exploit code is republished here. See the GitHub Issue Tracker and VulDB CVE-2026-19371 for further technical detail.

Detection Methods for CVE-2026-19371

Indicators of Compromise

Invocations of the comfy_upload_image MCP tool where image_path contains ../, ..\, or absolute path prefixes such as /etc/, /home/, or C:\.
Unexpected file copies performed by the Node.js process hosting claude-comfyui-mcp outside its configured image directory.
MCP server log entries showing copyFileSync operations targeting files with sensitive extensions such as .env, .key, or shell history files.

Detection Strategies

Instrument the MCP server to log the resolved absolute path of every image_path argument and alert when the resolved path escapes the configured uploads directory.
Apply endpoint monitoring rules that flag the node process reading files outside its working directory shortly after MCP tool calls.
Review the GitHub issue tracker and VulDB references for updated indicators as the maintainer responds.

Monitoring Recommendations

Enable file integrity monitoring on directories that host the MCP server binaries, configuration, and any user home directory the server can read.
Capture command-line arguments and file access telemetry for Node.js processes running MCP servers to support retrospective hunting.
Aggregate MCP tool-call audit logs into a central log store so traversal patterns can be searched across all connected agents.

How to Mitigate CVE-2026-19371

Immediate Actions Required

Restrict who can invoke the claude-comfyui-mcp server; run it under a dedicated low-privilege account with access limited to its uploads directory.
Audit any prompts, plugins, or integrations that can supply image_path to the comfy_upload_image tool and reject values containing traversal sequences or absolute paths.
Isolate the MCP server in a container or sandbox that has no filesystem access outside its designated working directories.

Patch Information

At the time of publication no upstream patch is available. The maintainer was notified through the GitHub Issue Tracker but has not responded. Monitor the claude-comfyui-mcp repository and VulDB CVE-2026-19371 for a fixed release.

Workarounds

Fork the project locally and add path canonicalization in src/tools/utils.ts so image_path is resolved with path.resolve and rejected if it does not start with the configured uploads directory.
Deploy an OS-level mandatory access control profile (AppArmor, SELinux, or a container readOnlyRootFilesystem with a narrow volume mount) so copyFileSync cannot reach sensitive paths even if traversal succeeds.
Disable or remove the comfy_upload_image tool from the MCP server manifest until a validated patch is released.

bash

# Example hardening: run claude-comfyui-mcp inside a container with a scoped mount
docker run --rm \
  --user 1001:1001 \
  --read-only \
  --tmpfs /tmp \
  -v /srv/comfyui/uploads:/app/uploads:rw \
  -w /app \
  node:20-alpine node ./dist/server.js