CVE-2026-7738

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.3 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L                                    

Vulnerability Description

A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function create_document/open_document of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability Details

Published Date

May 04, 2026

Last Modified

May 05, 2026

CWE ID

CWE-22

Source

NVD

External References

https://github.com/BruceJqs/public_exp/issues/38
https://github.com/puchunjie/doc-tools-mcp/
https://github.com/puchunjie/doc-tools-mcp/issues/4
https://vuldb.com/submit/807642
https://vuldb.com/vuln/360913
https://vuldb.com/vuln/360913/cti

CVE-2026-7738

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment