PT-2026-35532 · Unknown · Mkdocs-Mcp-Plugin

Smallw · CVE-2026-7159 · Published 2026-04-27 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions douinc mkdocs-mcp-plugin versions prior to 0.4.2

Description A path traversal issue exists in the read document() and list documents() functions within the server.py file. A remote attacker can exploit this by manipulating the docs dir or file path arguments to access files outside the intended directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the read document() and list documents() functions to minimize the risk of exploitation.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7159

GHSA-WFR3-HF93-QGG3

PYSEC-2026-2653

Affected Products

Mkdocs-Mcp-Plugin

References · 13

• 🔥 https://github.com/douinc/mkdocs-mcp-plugin/issues/6 · Exploit
• https://osv.dev/vulnerability/GHSA-wfr3-hf93-qgg3 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7159 · Security Note
• https://github.com/douinc/mkdocs-mcp-plugin/issues/6#issuecomment-4223718119 · Note
• https://github.com/douinc/mkdocs-mcp-plugin · Note
• https://t.me/cveNotify/161157 · Telegram Post
• https://vuldb.com/vuln/359758/cti · Note
• https://github.com/advisories/GHSA-wfr3-hf93-qgg3 · Note
• https://vuldb.com/vuln/359758 · Note
• https://pypi.org/project/mkdocs-mcp-plugin · Note
• https://twitter.com/CVEnew/status/2048910090875654167 · Twitter Post
• https://vuldb.com/submit/802063 · Note