CVE-2026-19336

MEDIUM

CVE: CVE-2026-19336 - A vulnerability was found in Pimzino spec-workflow-mcp up to 2Sign in to save

CVSS

5.3

CVSS v3.1

EPSS

0.1%

Exploit Prediction Score

Published

August 9, 2026

Exploitability

EPSS probability 0.1%

Description

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access. Upgrading to version 2.2.7 is capable of addressing this issue. The patch is named 9c7a7839e690bb4543f0e7481b5740d23808e5fe. It is advisable to upgrade the affected component.

Weaknesses

CWE-22

Affected Packages

No package data available.

Aliases

CVE-2026-19336

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/Pimzino/spec-workflow-mcp/
https://github.com/Pimzino/spec-workflow-mcp/commit/9c7a7839e690bb4543f0e7481b5740d23808e5fe
https://github.com/Pimzino/spec-workflow-mcp/issues/220
https://github.com/Pimzino/spec-workflow-mcp/pull/222
https://vuldb.com/cve/CVE-2026-19336
https://vuldb.com/submit/865260
https://vuldb.com/vuln/387172
https://vuldb.com/vuln/387172/cti