This vulnerability exists in the copyFileSync function of the comfy_upload_image component in Nikolaibibo claude-comfyui-mcp 1.0.0. By manipulating the image_path argument, a local attacker with low privileges can perform path traversal, potentially accessing or overwriting files outside the intended directory. The issue was reported early to the project but remains unaddressed.

An attacker with local access and limited privileges can exploit this vulnerability to traverse directories via the image_path argument. This could lead to unauthorized access or modification of files outside the intended scope, potentially impacting system integrity or confidentiality. However, exploitation requires local access and no user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted users only and monitor for any suspicious activity related to file operations involving image_path until an official fix is available.