CVE-2026-7314
A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get_doc_path of the file src/spire_doc_mcp/api/base.py. Performing a manipulation of the argument document_name results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Ver en NVDAnálisis
This is a path traversal vulnerability in a specific Model Context Protocol (MCP) server for the Spire.Doc library. While MCP is a popular emerging standard for AI tools, this specific implementation for a commercial document library is niche and unlikely to be widely deployed across the community infrastructure or common development stacks.
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCWE-22EPSS
Descripción técnica
A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get_doc_path of the file src/spire_doc_mcp/api/base.py. Performing a manipulation of the argument document_name results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.