What’s Vulnerable › Vulnerabilities

CVE-2026-19372: Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFileSync path traversal

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-09 · updated 2026-10-23
• Weakness: CWE-22

Description

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component upload_document. Performing a manipulation of the argument File results in path traversal. Attacking locally is a requirement. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

• handwriting-ocr-mcp-server: 0.1.0

References

• https://github.com/Handwriting-OCR/handwriting-ocr-mcp-server/
• https://github.com/Handwriting-OCR/handwriting-ocr-mcp-server/issues/6
• https://vuldb.com/cve/CVE-2026-19372
• https://vuldb.com/submit/866270
• https://vuldb.com/vuln/387256
• https://vuldb.com/vuln/387256/cti
• https://github.com/Handwriting-OCR/handwriting-ocr-mcp-server/issues/6

Get alerted when CVE-2026-19372 or the next vulnerability affects your stack