This vulnerability exists in the copyFileSync function of src/tools/utils.ts within the comfy_upload_image component of Nikolaibibo claude-comfyui-mcp 1.0.0. By manipulating the image_path argument, an attacker with local access can perform path traversal, potentially accessing or overwriting files outside the intended directory. The vulnerability was reported early to the project, but no response or fix has been issued. The CVSS 4.0 base score is 4.8, reflecting medium severity with local attack vector, low complexity, and limited impact on confidentiality, integrity, and availability.

An attacker with local access and low privileges can exploit this vulnerability to traverse directories via the image_path argument, potentially reading or writing files outside the intended scope. The impact on confidentiality, integrity, and availability is limited but present. There is no evidence of active exploitation in the wild.

No official fix or patch is currently available. Since the vendor has not responded, users should restrict local access to trusted users only and monitor for any suspicious activity involving file operations in the affected component. Check the vendor advisory or project repository regularly for updates or patches.