CVE-2026-19270— Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal
Possible ATT&CK Techniques 1AI
T1564.001 · Hidden Files and DirectoriesGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-19270
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path traversal. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Hulupeep | mcp-ui-probe | 0.1 | cpe:2.3:a:hulupeep:mcp-ui-probe:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-19270
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19270
请登录查看更多情报信息。
News Coverage for CVE-2026-19270 (1)
IV. Related Vulnerabilities
Same weakness: CWE-22
- CVE-2026-47243
Kata guest escape: runtime-rs guest-root to host-root escape - CVE-2026-47661
Pathling has path traversal in $result endpoint that allows - CVE-2026-47659
Pathling has path traversal in $import-pnp manifest that ena - CVE-2026-19016
Authorization bypass for session deletion in the transaction - CVE-2026-71557
go-git: Malicious reference names may modify files outside t
V. Comments for CVE-2026-19270
No comments yet