Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-19270

Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulDB

Description

A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path traversal. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Hulupeep mcp-ui-probe

  • 0.1affected
  • 0.2.0affected

References