PT-2026-36006 · Getsimpletool · Mcpo-Simple-Server

Largew · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-7404

Mitre

CVSS v3.1

7.3

High

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected is the function delete shared prompt of the file src/mcpo simple server/services/prompt manager/base manager.py. This manipulation of the argument detail causes relative path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2026-7404

Affected Products

Mcpo-Simple-Server

References · 6

• 🔥 https://github.com/getsimpletool/mcpo-simple-server/issues/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7404 · Security Note
• https://vuldb.com/vuln/360140/cti · Note
• https://github.com/getsimpletool/mcpo-simple-server · Note
• https://vuldb.com/vuln/360140 · Note
• https://vuldb.com/submit/803612 · Note