CVE-2026-15749 is a path traversal vulnerability affecting mastergo-design's mastergo-magic-mcp product versions 0.1 and 0.2.0. The issue resides in the execute function within src/tools/get-c2d.ts of the mcp__C2d component. By manipulating the filePath argument, a local attacker can perform path traversal, potentially accessing files outside intended directories. The vulnerability requires local privileges to exploit. Although the vulnerability was reported early, the vendor has not provided a patch or official remediation. Public exploit code is available, increasing the risk of exploitation.

An attacker with local access can exploit this vulnerability to traverse directories via the filePath argument, potentially accessing sensitive files outside the intended scope. The impact is limited by the requirement for local access and the medium CVSS score of 4.8. No remote exploitation or privilege escalation is indicated in the available data.

No official fix or patch is currently available from the vendor. Users should restrict local access to trusted users only and monitor for any suspicious local activity involving the mastergo-magic-mcp component. Check the vendor's advisory channels regularly for updates or patches addressing this vulnerability.