CVE-2026-116045 Details
Description
A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as c8c2951dcbed9b1710a745993f028317f10a3f10. Applying a patch is advised to resolve this issue.
A path traversal vulnerability has been identified in 1999AZZAR designer-mcp versions through 2.1.0. The issue arises in the MCP Interface component, specifically within the 'get_reference' function of the 'skills/motion-designer/references/motion-dev-guidelines.md' file. The vulnerability allows remote attackers to manipulate the 'Name' argument, escaping the intended directory and accessing arbitrary markdown files readable by the server process. This could lead to unauthorized disclosure of internal documentation or sensitive information.
Users are advised to update to version 2.2.0 or later, where this vulnerability has been fixed. The patch involves implementing proper path validation to prevent traversal attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/1999AZZAR/designer-mcp/ | [email protected] | Source CodeVendor |
| https://github.com/1999AZZAR/designer-mcp/commit/c8c2951dcbed9b1710a745993f028317f10a3f10 | [email protected] | Source CodeVendor |
| https://github.com/1999AZZAR/designer-mcp/issues/14 | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-116045 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/994010 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426121 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426121/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 1999AZZAR designer-mcp | <= 2.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |