CVE-2026-19372

EUVD-2026-54959
A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component upload_document. Performing a manipulation of the argument File results in path traversal. Attacking locally is a requirement. The project was informed of the problem early through an issue report but has not responded yet.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 3.81%
Common Weakness Enumeration
References
https://github.com/Handwriting-OCR/handwriting-ocr-mcp-server/
https://github.com/Handwriting-OCR/handwriting-ocr-mcp-server/issues/6
https://vuldb.com/cve/CVE-2026-19372
https://vuldb.com/submit/866270
https://vuldb.com/vuln/387256
https://vuldb.com/vuln/387256/cti
https://github.com/Handwriting-OCR/handwriting-ocr-mcp-server/issues/6