CVE-2026-7404

HIGH

getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal

Title source: cna
STIX 2.1

Description

A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected is the function delete_shared_prompt of the file src/mcpo_simple_server/services/prompt_manager/base_manager.py. This manipulation of the argument detail causes relative path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-360140 | getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal
https://vuldb.com/vuln/360140
Signature, Permissions Required signature permissions-required
VDB-360140 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/360140/cti
Third Party Advisory third-party-advisory
Submit #803612 | getsimpletool simpletool-server 035efb1c98076ca3febd5e1f5fc3960f81a16af8 Pathname Traversal
https://vuldb.com/submit/803612

Scores

CVSS v3 7.3
EPSS 0.0051
EPSS Percentile 39.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22 CWE-23
Status published
Products (3)
getsimpletool/mcpo-simple-server 0.1
getsimpletool/mcpo-simple-server 0.2.0
pypi/mcpo-simple-server 0 - 0.2.0PyPI
Published Apr 29, 2026
Tracked Since Apr 30, 2026