CVE-2026-7400

HIGH

geekgod382 filesystem-mcp-server read_file_tool/write_file_tool server.py is_path_allowed path traversal

Title source: cna
STIX 2.1

Description

A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0. This issue affects the function is_path_allowed of the file server.py of the component read_file_tool/write_file_tool. Such manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.1.0 is capable of addressing this issue. The name of the patch is 45364545fc60dc80aadcd4379f08042d3d3d292e. Upgrading the affected component is advised.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-360123 | geekgod382 filesystem-mcp-server read_file_tool/write_file_tool server.py is_path_allowed path traversal
https://vuldb.com/vuln/360123
Signature, Permissions Required signature permissions-required
VDB-360123 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/360123/cti
Third Party Advisory third-party-advisory
Submit #803495 | geekgod382 filesystem-mcp-server 4e3e83852b1395de0a437bd4fd66376422f4ea0c Path Traversal
https://vuldb.com/submit/803495

Scores

CVSS v3 7.3
EPSS 0.0043
EPSS Percentile 34.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
geekgod382/filesystem-mcp-server 1.0.0
geekgod382/filesystem-mcp-server 1.1.0
Published Apr 29, 2026
Tracked Since Apr 30, 2026