PT-2026-35827 · Eiceblue · Spire-Doc-Mcp-Server

Littlew · Published 2026-04-28 · Updated 2026-04-29 · CVE-2026-7314

NVD

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get doc path of the file src/spire doc mcp/api/base.py. Performing a manipulation of the argument document name results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7314

Affected Products

Spire-Doc-Mcp-Server

References · 9

• 🔥 https://github.com/eiceblue/spire-doc-mcp-server/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7314 · Security Note
• https://twitter.com/lyrie_ai/status/2049615016169447651 · Twitter Post
• https://vuldb.com/submit/803080 · Note
• https://twitter.com/lyrie_ai/status/2049615015313834101 · Twitter Post
• https://twitter.com/lyrie_ai/status/2049615017071251836 · Twitter Post
• https://vuldb.com/vuln/359962/cti · Note
• https://vuldb.com/vuln/359962 · Note
• https://github.com/eiceblue/spire-doc-mcp-server · Note