Vulnerability · Published Aug 9, 2026 · Assigned by VulDB

CVE-2026-19336Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal

Medium 5.3

In plain English

A medium-severity path traversal in spec-workflow-mcp from Pimzino. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 90.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access. Upgrading to version 2.2.7 is capable of addressing this issue. The patch is named 9c7a7839e690bb4543f0e7481b5740d23808e5fe. It is advisable to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
Pimzino	spec-workflow-mcp	2.2.02.2.12.2.22.2.32.2.42.2.52.2.6

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References

VDB-387172 | Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal vdb-entry, technical-description
VDB-387172 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19336 | CVE Analysis and Report third-party-advisory
Submit #865260 | Pimzino spec-workflow-mcp 2.2.6 Path Traversal third-party-advisory
https://github.com/Pimzino/spec-workflow-mcp/issues/220 issue-tracking
https://github.com/Pimzino/spec-workflow-mcp/pull/222 issue-tracking, patch
https://github.com/Pimzino/spec-workflow-mcp/commit/9c7a7839e690bb4543f0e7481b5740d23808e5fe patch
https://github.com/Pimzino/spec-workflow-mcp/ product