CVE-2026-19331

This path traversal in an MCP server matters beyond its CVSS 5.3 rating because the vulnerability lives in a component designed to translate LLM requests into filesystem operations. A path traversal in a traditional web app gives an attacker a way to read files they shouldn't—bad, but scoped. The same vulnerability in an MCP server gives an attacker a way to make a trusted AI workflow read files it shouldn't, using the LLM itself as the exploit vehicle rather than needing direct access. The critical distinction: if your agentic pipeline includes this MCP server, the attack surface isn't just 'can a local user manipulate the server'—it's 'can prompt injection convince the LLM to generate a malicious path-traversal request as part of its reasoning.' That's a fundamentally different threat model. The LLM becomes an active participant in the exploit, not a passive relay. You don't need to compromise the server directly; you need to compromise the prompts or context the LLM uses. The maintainer non-response compounds this. Without a patch, there's no fix timeline—and worse, no public acknowledgment that a fix is coming. This transforms the vulnerability from a bug into a permanent feature of any AI workflow that chains this server. Every new agentic pipeline that adopts it widens the blast radius retroactively. The exposure isn't the vulnerability getting worse; it's the ecosystem inheriting it at scale. What to check: audit your agent configurations, MCP server definitions, and prompt templates for any references to this or similar file-system MCP integrations. If you depend on MCP servers for AI workflows handling sensitive data, treat the maintenance status of the server as a security control—unmaintained integrations are now supply-chain debt that accrues interest as adoption grows.

Reviewed through automated stages and approved by a human before publication.