CVE-2026-55156

# Unauthenticated Path Traversal in Dashboard Session Log API Endpoints | Field | Value | | ---------------- | ----- | | Repository | ooples/token-optimizer-mcp | | Affected version | 5.0.1 (commit 8137147) | | Vulnerability | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory | | Severity | Medium | | CVSS 3.1 | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) | ## Summary The dashboard HTTP server in `token-optimizer-mcp` exposes `/api/session-summary` and `/api/session-events` with no authentication middleware — any network-accessible client can reach them without credentials. Both handlers concatenate the caller-supplied `sessionId` query parameter directly into a filesystem path via `path.join`, and Node.js normalizes `..` segments at resolution time, allowing an unauthenticated attacker to read any `.jsonl` file reachable from the server's filesystem. Successful reproduction confirmed exfiltration of a `.jsonl` file located outside the intended `hooksDataPath` directory with a single unauthenticated HTTP GET request. ## Affected Code `src/server/web-server.ts:73–88` — `/api/session-summary`: unsanitized `sessionId` interpolated into `path.join` then passed to `fs.readFileSync` ```typescript const hooksDataPath = getHooksDataPath(); const jsonlFilePath = path.join( hooksDataPath, `session-log-${sessionId}.jsonl` ); if (!fs.existsSync(jsonlFilePath)) { return res.status(404).json({ success: false, error: `JSONL log not found for session ${sessionId}`, sessionId, }); } // Parse JSONL file const jsonlContent = fs.readFileSync(jsonlFilePath, 'utf-8'); ``` `src/server/web-server.ts:297–311` — `/api/session-events`: identical unsanitized `path.join` + `fs.readFileSync` pattern ```typescript const hooksDataPath = getHooksDataPath(); const jsonlFilePath = path.join( hooksDataPath, `session-log-${sessionId}.js