CVE-2026-82111: getnote-mcp Path Traversal Vulnerability

CVE-2026-82111 Overview

CVE-2026-82111 is a path traversal vulnerability [CWE-22] in the iswalle/getnote-mcp project through version 1.5.0. The flaw resides in the upload_image component, specifically in the fs.readFileSync call within src/index.ts. An attacker with low-privileged remote access can manipulate the image_path argument to read arbitrary files outside the intended directory. The exploit is publicly disclosed. Upgrading to version 1.5.1, which contains commit 7f9a215e03575c650d38c8f87fc6d8d363fed80d, remediates the issue.

Critical Impact
A remote authenticated attacker can supply crafted path values to image_path and cause the upload_image tool to read sensitive host files, then exfiltrate them by uploading the content to a public CDN.

Affected Products

iswalle/getnote-mcp versions up to and including 1.5.0
Component: upload_image in src/index.ts
Fixed release: iswalle/getnote-mcp version 1.5.1

Discovery Timeline

2026-08-28 - CVE-2026-82111 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82111

Vulnerability Analysis

The getnote-mcp server exposes a Model Context Protocol (MCP) tool named upload_image. This tool accepts an image_path parameter, reads the referenced file using fs.readFileSync, and uploads the byte content to a public content delivery network (CDN). Versions up to 1.5.0 do not validate or canonicalize the supplied path. As a result, any caller that can invoke the MCP tool can point image_path at arbitrary host files. Because the content is then published to a CDN, the flaw effectively becomes an arbitrary file read with external exfiltration.

Root Cause

The root cause is missing input validation on image_path [CWE-22]. The original implementation imported only readFileSync from node:fs and join from node:path, with no logic to reject absolute paths, .. segments, null bytes, or symbolic links that escape an allowed root. Any string supplied by the caller is passed directly to fs.readFileSync.

Attack Vector

An attacker who can reach the MCP endpoint and holds low privileges issues an upload_image request with a traversal payload in image_path, such as ../../etc/passwd or /root/.ssh/id_rsa. The server reads the file and uploads its content to the CDN, returning a public URL the attacker can retrieve. No user interaction is required.

typescript

// Security patch in src/index.ts (v1.5.1)
// Source: https://github.com/iswalle/getnote-mcp/commit/7f9a215e03575c650d38c8f87fc6d8d363fed80d

-import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { readFileSync, realpathSync } from "node:fs";
+import { join, resolve, isAbsolute, sep } from "node:path";

// Validation strategy introduced by the patch:
//  - Reject null bytes (syscalls truncate at \0, bypassing later checks)
//  - Reject absolute paths (leading / or \, or platform-detected absolute)
//  - Reject any path segment containing ".."
//  - If GETNOTE_MCP_ALLOWED_ROOT is set, resolve via realpathSync + resolve
//    and require the final real path to remain inside that root (blocks symlink escape)
//  - Otherwise, allow only relative paths under the current working directory

Source: GitHub commit 7f9a215e03575c650d38c8f87fc6d8d363fed80d

Detection Methods for CVE-2026-82111

Indicators of Compromise

MCP upload_image calls where image_path contains .., backslash sequences, or begins with / or a drive letter.
fs.readFileSync reads of sensitive files such as /etc/passwd, /root/.ssh/id_rsa, or application secrets originating from the getnote-mcp process.
Outbound uploads to the configured CDN endpoint whose payload matches the byte size of host system files rather than genuine images.

Detection Strategies

Enable verbose logging on the MCP server and alert on image_path values that fail the v1.5.1 validation predicates (isAbsolute, .., null byte).
Monitor the Node.js process for openat/open syscalls targeting paths outside the intended working directory using auditd or eBPF instrumentation.
Correlate upload_image invocations with subsequent CDN uploads whose MIME types do not match image formats.

Monitoring Recommendations

Track the getnote-mcp package version across development hosts and CI runners; flag any instance below 1.5.1.
Alert on new symbolic links appearing inside directories referenced by GETNOTE_MCP_ALLOWED_ROOT.
Review authentication and authorization logs for the MCP transport to identify unexpected low-privileged callers issuing upload_image requests.

How to Mitigate CVE-2026-82111

Immediate Actions Required

Upgrade iswalle/getnote-mcp to version 1.5.1 or later using the release tagged at GitHub Release v1.5.1.
Set the GETNOTE_MCP_ALLOWED_ROOT environment variable to a narrow, dedicated directory that contains only files intended for upload.
Restrict which principals can invoke MCP tools on the server, and rotate any credentials or secrets stored on hosts that ran vulnerable versions.

Patch Information

The fix is delivered in commit 7f9a215e03575c650d38c8f87fc6d8d363fed80d, merged via Pull Request #11 and released as version 1.5.1. The patch adds path validation that rejects null bytes, absolute paths, and .. segments, and resolves symbolic links with realpathSync before checking that the final path stays inside the allowed root. See GitHub Issue #10 for the original report and VulDB entry #396502 for advisory metadata.

Workarounds

If upgrading is not immediately possible, disable the upload_image tool in the MCP server configuration.
Run the getnote-mcp process under a dedicated low-privileged user account with filesystem access limited to a chroot or container path containing only upload-eligible files.
Place the MCP endpoint behind an authenticated proxy that rejects request payloads where image_path contains .., null bytes, or begins with / or a drive letter.

bash

# Upgrade to the patched release
npm install getnote-mcp@1.5.1

# Constrain file reads to a dedicated upload directory
export GETNOTE_MCP_ALLOWED_ROOT="/var/lib/getnote-mcp/uploads"

# Verify installed version
npm ls getnote-mcp