CVE-2026-19372 | Handwriting-OCR handwriting-ocr-mcp-server 0.1.0 upload_document src/index.ts fs.readFileSync File path traversal

A vulnerability, which was classified as critical, has been found in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component upload_document. Performing a manipulation of the argument File results in path traversal.

This vulnerability is known as CVE-2026-19372. Attacking locally is a requirement. Furthermore, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.