PT-2026-35827 · Eiceblue · Spire-Doc-Mcp-Server

Littlew · Publicado 2026-04-28 · Atualizado 2026-04-29 · CVE-2026-7314

NVD

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get doc path of the file src/spire doc mcp/api/base.py. Performing a manipulation of the argument document name results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-7314

Produtos afetados

Spire-Doc-Mcp-Server

Referências · 9

• 🔥 https://github.com/eiceblue/spire-doc-mcp-server/issues/1 · Exploit
• https://twitter.com/lyrie_ai/status/2049615016169447651 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-7314 · Nota de Segurança
• https://vuldb.com/submit/803080 · Nota
• https://twitter.com/lyrie_ai/status/2049615015313834101 · Publicação no Twitter
• https://twitter.com/lyrie_ai/status/2049615017071251836 · Publicação no Twitter
• https://vuldb.com/vuln/359962/cti · Nota
• https://vuldb.com/vuln/359962 · Nota
• https://github.com/eiceblue/spire-doc-mcp-server · Nota