CVE-2026-82111: Path Traversal in iswalle getnote-mcp
Description
CVE-2026-82111 is a path traversal vulnerability in the iswalle getnote-mcp component up to version 1.5.0. It occurs in the fs.readFileSync function within the src/index.ts file of the upload_image component. An attacker can remotely manipulate the image_path argument to perform path traversal. The vulnerability has a medium severity with a CVSS score of 5.3. The issue is fixed by upgrading to version 1.5.1.
CVSS v4.0
Score 5.3medium
Affected software
iswalle
getnote-mcp
cpe:2.3:a:iswalle:getnote-mcp:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in iswalle getnote-mcp (up to 1.5.0) involves improper handling of the image_path argument in the fs.readFileSync function of src/index.ts in the upload_image component. This allows an attacker to perform path traversal attacks remotely, potentially accessing unauthorized files. The vulnerability is addressed by upgrading to version 1.5.1, which includes a patch identified by commit 7f9a215e03575c650d38c8f87fc6d8d363fed80d.
Potential Impact
An attacker can remotely exploit this vulnerability to perform path traversal, potentially reading arbitrary files on the affected system. This could lead to unauthorized information disclosure depending on the files accessed. The CVSS score of 5.3 indicates a medium severity impact.
Mitigation Recommendations
Upgrading the iswalle getnote-mcp component to version 1.5.1 fully resolves this vulnerability. Users should apply this update promptly to mitigate the risk. No other mitigation steps are indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-28T05:20:18.388Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a916f8facd9273b49cf9292
Added to database: 08/28/2026, 11:22:55 UTC
Last enriched: 09/07/2026, 15:28:33 UTC
Last updated: 10/10/2026, 18:48:23 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.