CVE-2026-15749 is a path traversal vulnerability affecting mastergo-design's mastergo-magic-mcp product up to version 0.2.0. The vulnerability resides in the execute function of src/tools/get-c2d.ts in the mcp__C2d component. By manipulating the filePath argument, a local attacker can traverse directories beyond intended boundaries. The vulnerability requires local access and does not require user interaction. Although the issue was reported early, the vendor has not provided a patch or official remediation. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows a local attacker to access files outside the intended directory structure by exploiting the path traversal flaw. This could lead to unauthorized reading of sensitive files accessible by the application context. The vulnerability does not require elevated privileges beyond local access, but the impact is limited to the permissions of the affected process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for any updates from the vendor. Avoid running the affected versions (0.1 and 0.2.0) in untrusted environments until a fix is available.