PT-2026-35972 · Unknown · Bioinfomcp

Littlew · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-7398

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions florensiawidjaja BioinfoMCP versions up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54

Description A path traversal issue exists in the Upload Endpoint component within the Upload() function of the bioinfo mcp platform/app.py file. A remote attacker can exploit this by manipulating the Name argument, allowing files to be written to or read from arbitrary locations on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7398

Affected Products

Bioinfomcp

References · 7

• 🔥 https://github.com/florensiawidjaja/BioinfoMCP/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7398 · Security Note
• https://vuldb.com/vuln/360122/cti · Note
• https://vuldb.com/submit/803488 · Note
• https://github.com/florensiawidjaja/BioinfoMCP · Note
• https://vuldb.com/vuln/360122 · Note
• https://twitter.com/CVEnew/status/2049578374457405882 · Twitter Post