PT-2026-35828 · Eiceblue · Spire-Pdf-Mcp-Server

Littlew · Published 2026-04-28 · Updated 2026-04-29 · CVE-2026-7315

NVD

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get pdf path of the file src/spire pdf mcp/server.py of the component PDF File Handler. Executing a manipulation of the argument filepath can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7315

Affected Products

Spire-Pdf-Mcp-Server

References · 8

• 🔥 https://github.com/eiceblue/spire-pdf-mcp-server/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7315 · Security Note
• https://vuldb.com/submit/803081 · Note
• https://twitter.com/lyrie_ai/status/2049615016169447651 · Twitter Post
• https://twitter.com/lyrie_ai/status/2049615015313834101 · Twitter Post
• https://vuldb.com/vuln/359963 · Note
• https://github.com/eiceblue/spire-pdf-mcp-server · Note
• https://vuldb.com/vuln/359963/cti · Note