Description

A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfy_upload_image. Such manipulation of the argument image_path leads to path traversal. An attack has to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T23:16:35.943Z",
  "pubdate": "2026-08-09T23:16:35.943Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the Nikolaibibo claude-comfyui-mcp version 1.0.0 component comfy_upload_image. The flaw exists within the copyFileSync function located in src/tools/utils.ts, where insufficient sanitization of the image_path argument allows unauthorized file system access.\nThe vulnerability enables an attacker with local access to manipulate the input argument, potentially leading to arbitrary file read or write operations depending on the execution context of the underlying process. This compromises the integrity and confidentiality of the host system.\nThe risk implication is significant as sensitive files residing outside the intended operational directory can be accessed or targeted. Exploitation requires local access to the system executing the affected component, and the vendor has not yet responded to early issue reports regarding the vulnerability.",
  "technicalDetails": "The vulnerability stems from improper neutralization of user-supplied input delivered via the image_path argument within the copyFileSync function, implemented in src/tools/utils.ts as part of the comfy_upload_image component of Nikolaibibo claude-comfyui-mcp version 1.0.0.\nDuring execution, the application processes the image_path parameter to perform file synchronization or copy operations. Because the function fails to adequately validate or canonicalize the input path to ensure it remains restricted to the designated base directory, malicious directory traversal sequences such as dot-dot-slash (../) can be injected.\nThe attack flow proceeds as follows: First, the local attacker crafts a malicious payload containing traversal sequences within the image_path argument. Second, the input is passed directly into the vulnerable copyFileSync utility without rigorous sanitization or boundary enforcement. Third, the underlying file system operations resolve the path outside the intended directory scope, allowing the process to interact with arbitrary files accessible to the application's security context.\nAuthentication and privilege requirements are dictated by the local execution environment, necessitating local access to supply the manipulated argument to the MCP component. There is no direct network exposure required for this specific vector, as the attack is approached locally. Post-exploitation impact includes unauthorized exposure of sensitive system files or unauthorized file modification, depending on how the copied file destinations are handled by the application logic."
}