Description

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access. Upgrading to version 2.2.7 is capable of addressing this issue. The patch is named 9c7a7839e690bb4543f0e7481b5740d23808e5fe. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T06:19:55.713Z",
  "pubdate": "2026-08-09T06:19:55.713Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the Pimzino spec-workflow-mcp package affecting versions up to 2.2.6. The flaw resides within the ApprovalStorage.createApproval function located in src/tools/approvals.ts. The vulnerability allows a local actor to manipulate the categoryName argument, leading to arbitrary path traversal and unauthorized file system interactions. Successful exploitation can result in the manipulation or creation of files outside the intended storage directory, depending on the privileges of the executing process. The attack vector is strictly limited to local access, requiring the adversary to possess local execution capabilities on the host system. The risk is effectively mitigated by upgrading the affected software component to version 2.2.7, which incorporates the official patch identified by commit hash 9c7a7839e690bb4543f0e7481b5740d23808e5fe.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw stemming from insufficient sanitization and validation of user-supplied input within file system operations. Specifically, the execution flow involves the ApprovalStorage.createApproval function within the source file src/tools/approvals.ts.\nThe root cause of the issue lies in the direct usage of the categoryName argument without proper canonicalization or neutralization of directory traversal sequences, such as dot-dot-slash (../) patterns. When a local user interacts with the affected component and supplies a specially crafted categoryName string containing traversal directives, the underlying file system operations resolve the path relative to an unintended base directory.\nThe attack flow proceeds as follows: First, the adversary invokes the vulnerable function with a crafted categoryName payload containing traversal sequences. Second, the ApprovalStorage.createApproval function processes the input parameter without enforcing structural boundaries or validating that the resulting path remains strictly contained within the intended storage directory. Third, the operating system evaluates the path, navigating outside the intended directory hierarchy due to the presence of relative path operators. Finally, the application performs file creation or write operations at the unintended destination path.\nThe exploitation prerequisites dictate that the attacker must have local access to the system executing the spec-workflow-mcp component. Network exposure is not required as the attack vector is localized. Privilege requirements depend on the execution context of the application, potentially allowing file write operations in sensitive directories if the process runs with elevated privileges. The post-exploitation impact includes unauthorized file creation and potential data overwriting within the constraints of the local user permissions.\nThe vulnerable component is identified as spec-workflow-mcp up to version 2.2.6, specifically targeting the ApprovalStorage.createApproval method in src/tools/approvals.ts."
}