Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L N N 2.1 .0055 43.8 —
AFFECTED Product Versions Fixed getnote-mcp 1.0 – 1.5.1
TIMELINE Aug 28 Reserved by VulDB Aug 28 Published (CNA: VulDB) Aug 31 EXPLOIT PUBLISHED — CVE-2026-82111 (iswalle getnote-mcp). Public exploit reference added.
A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component upload_image. Performing a manipulation of the argument image_path results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.5.1 is sufficient to fix this issue. The patch is named 7f9a215e03575c650d38c8f87fc6d8d363fed80d. Upgrading the affected component is advised.
| Date | Event | Detail |
|---|---|---|
| August 28, 2026 | Reserved | Reserved by VulDB |
| August 28, 2026 | Published | Published (CNA: VulDB) |
| August 31, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-82111 (iswalle getnote-mcp). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| iswalle | getnote-mcp | — | 1.0 | 1.5.1 |
Authoritative record: CVE-2026-82111 at cve.org
Vendors: iswalle
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-82111 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
