The vulnerability CVE-2026-43989 affects the junoclaw product by Dragonmonk111. The upload_wasm MCP tool prior to version 0.x.y-security-1 allows an agent to specify a filesystem path that is used to upload arbitrary bytes without validation of path location, symbolic link targets, file size, or file format. This constitutes improper input validation (CWE-20) and relates to path traversal (CWE-22), symbolic link issues (CWE-59), and improper handling of file operations (CWE-73). The CVSS 3.1 score is 8.5, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impact with low availability impact. The vulnerability is fixed in version 0.x.y-security-1.

Successful exploitation allows an attacker with local access and user interaction to cause a scope change affecting confidentiality and integrity severely, and availability to a lesser extent. The attacker can upload arbitrary files from the filesystem without validation, potentially leading to unauthorized disclosure or modification of sensitive data.

A fix is available in version 0.x.y-security-1 of junoclaw. Users should upgrade to this version to remediate the vulnerability. Since the product is not a cloud service and no official remediation level is provided beyond the fix, upgrading is the recommended action. Patch status is confirmed by the vendor statement that the vulnerability is fixed in 0.x.y-security-1.