CVE-2026-19365 describes a path traversal vulnerability in Ichigo3766 image-gen-mcp 0.1.0. The flaw is located in an unknown function of the src/index.ts file within the upscale_images component. By manipulating the output_path argument, a local attacker with low privileges can traverse directories outside the intended path. The vulnerability requires local access and does not involve user interaction. The project was notified early but has not issued a patch or response.

An attacker with local access and low privileges can exploit this vulnerability to perform path traversal, potentially accessing or modifying files outside the intended directory. The impact includes limited confidentiality, integrity, and availability consequences as indicated by the CVSS vector (C:L/I:L/A:L). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should restrict local access to trusted users only and monitor for updates from the vendor before deploying in sensitive environments.