PT-2026-36781 · Puchunjie · Doc-Tools-Mcp

Brucejqs · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-7738

NVD

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function create document/open document of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7738

Affected Products

Doc-Tools-Mcp

References · 7

• 🔥 https://github.com/BruceJqs/public_exp/issues/38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7738 · Security Note
• https://github.com/puchunjie/doc-tools-mcp/issues/4 · Note
• https://vuldb.com/vuln/360913 · Note
• https://github.com/puchunjie/doc-tools-mcp · Note
• https://vuldb.com/vuln/360913/cti · Note
• https://vuldb.com/submit/807642 · Note