CVE-2026-81486
Received Received - Intake

Path Traversal in bsmi021 mcp-file-context-server

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulDB

Description
A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_context of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81486
EUVD
EUVD-2026-66833

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bsmi021 mcp-file-context-server 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the mcp-file-context-server 1.0.0. The read_context function in src/index.ts does not properly validate the path argument, allowing attackers to manipulate it to access files outside the intended project directory. The exploit is public and can be performed remotely.

Detection Guidance

Check if the mcp-file-context-server is running and inspect network traffic for MCP tool invocations with path arguments. Look for unusual file reads outside the intended workspace. Use commands like 'ps aux | grep mcp-file-context-server' to check processes and 'lsof -i' to monitor network connections.

Impact Analysis

If you run the vulnerable server, attackers could read sensitive files on your system that the server process has access to. This includes configuration files, source code, or other confidential data. The impact depends on the server's permissions and the files it can access.

Compliance Impact

This vulnerability allows remote attackers to read arbitrary files on the server due to path traversal. For GDPR, this could lead to unauthorized access to personal data, violating confidentiality requirements. For HIPAA, it may expose protected health information if accessible by the server process. Both standards mandate strict access controls and data protection measures.

Mitigation Strategies

Immediately restrict the server to an allowlisted workspace, validate all path inputs to prevent traversal, and ensure the server process runs with minimal filesystem permissions. Disable the vulnerable MCP tool if possible and monitor for unauthorized file access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81486. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart