CVE-2026-19336

Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal

State: Published
Severity: 4.8 Medium
Published: Aug 9, 2026
Updated: Aug 10, 2026
Reserved: Aug 8, 2026

Description

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access. Upgrading to version 2.2.7 is capable of addressing this issue. The patch is named 9c7a7839e690bb4543f0e7481b5740d23808e5fe. It is advisable to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
spec-workflow-mcpPimzino	2.2.0Affected 2.2.1Affected 2.2.2Affected 2.2.3Affected 2.2.4Affected 2.2.5Affected 2.2.6Affected 2.2.7Not affected

References

VDB-387172 | Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversalvdb-entrytechnical-description
VDB-387172 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-19336 | CVE Analysis and Reportthird-party-advisory
Submit #865260 | Pimzino spec-workflow-mcp 2.2.6 Path Traversalthird-party-advisory
https://github.com/Pimzino/spec-workflow-mcp/issues/220issue-tracking
https://github.com/Pimzino/spec-workflow-mcp/pull/222issue-trackingpatch
https://github.com/Pimzino/spec-workflow-mcp/commit/9c7a7839e690bb4543f0e7481b5740d23808e5fepatch
https://github.com/Pimzino/spec-workflow-mcp/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.