PT-2026-35831 · Elie · Mcp-Project

Littlew · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7318

Mitre

CVSS v3.1

5.9

Medium

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A vulnerability was detected in elie mcp-project 0.1.0. The affected element is the function search papers of the file research server.py. The manipulation of the argument topic results in path traversal. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7318

Affected Products

Mcp-Project

References · 5

• 🔥 https://github.com/elie/mcp-research-server/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7318 · Security Note
• https://vuldb.com/vuln/359971/cti · Note
• https://vuldb.com/submit/803083 · Note
• https://vuldb.com/vuln/359971 · Note