CVE-2026-81845

Deferred Deferred - Pending Action

Path Traversal in arben-adm mcp-sequential-thinking

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: VulDB

Description

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import_session/export_session of the file mcp_sequential_thinking/server.py of the component Import Session/Export Session. Such manipulation of the argument file_path leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.6.0 is recommended to address this issue. The name of the patch is 2fad3ee8ab1d0868b6c1afb5895bc336a10e5267. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81845

EUVD

EUVD-2026-67291

Affected Vendors & Products

Vendor	Product	Version / Range
arben-adm	mcp-sequential-thinking	to 0.5.0 (inc)
arben-adm	mcp-sequential-thinking	0.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-81845 is a path traversal vulnerability in the mcp-sequential-thinking package up to version 0.5.0. The issue exists in the import_session and export_session functions of mcp_sequential_thinking/server.py. These functions do not validate user-supplied file_path arguments, allowing attackers to manipulate file paths to read or write arbitrary files outside the intended storage directory. This can lead to unauthorized file access, data corruption, or denial-of-service attacks.

Detection Guidance

Check for unauthorized file writes or reads in the mcp-sequential-thinking server logs or storage directories. Look for suspicious paths containing traversal sequences like ../../../ or percent-encoded variants. Monitor for unexpected file creation in sensitive directories such as /etc, user home directories, or configuration files.

Impact Analysis

This vulnerability allows remote attackers to write arbitrary files anywhere the server process has write permissions, including sensitive system files like /etc/passwd. Attackers can also read JSON files, probe file existence, create lock files to disrupt other processes, or pre-position malicious payloads. The server runs with user privileges, making it exploitable via prompt injection attacks where users are tricked into calling these tools with malicious paths.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Unauthorized file writes or reads may result in data breaches, non-compliance with access controls, and failure to maintain data integrity, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade to version 0.6.0 or later of mcp-sequential-thinking. Disable the import_session and export_session tools if not required. Restrict server permissions to the minimum necessary. Review and remove any unauthorized files created by potential exploits. Monitor for unusual file activity in system directories.

Hi! I’m here to help you understand CVE-2026-81845. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70