PT-2026-35828 · Eiceblue · Spire-Pdf-Mcp-Server

Littlew · Publicado 2026-04-28 · Atualizado 2026-04-29 · CVE-2026-7315

NVD

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get pdf path of the file src/spire pdf mcp/server.py of the component PDF File Handler. Executing a manipulation of the argument filepath can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-7315

Produtos afetados

Spire-Pdf-Mcp-Server

Referências · 8

• 🔥 https://github.com/eiceblue/spire-pdf-mcp-server/issues/1 · Exploit
• https://vuldb.com/submit/803081 · Nota
• https://twitter.com/lyrie_ai/status/2049615016169447651 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-7315 · Nota de Segurança
• https://twitter.com/lyrie_ai/status/2049615015313834101 · Publicação no Twitter
• https://vuldb.com/vuln/359963 · Nota
• https://github.com/eiceblue/spire-pdf-mcp-server · Nota
• https://vuldb.com/vuln/359963/cti · Nota