EUVD-2026-43266
GHSA-xj39-q498-f3c8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low-privilege requirement match description; confidentiality-only impact reflects read access beyond project boundary with no integrity or availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-factory.ts. Such manipulation of the argument projectName leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in alioshr memory-bank-mcp through versions 0.2.1 and 3.1 allows a local low-privileged user to read files outside the intended project directory boundary by supplying traversal sequences in the projectName argument processed by list-project-files-validation-factory.ts. A public proof-of-concept has been disclosed via GitHub issue #36, and no patch is available as the vendor has not yet responded to the coordinated disclosure. No confirmed active exploitation has been identified (not listed in CISA KEV), though the public exploit lowers the barrier for opportunistic local abuse.
Technical ContextAI
memory-bank-mcp is a Model Context Protocol (MCP) server implementation by alioshr, designed to provide AI agents with persistent memory management capabilities organized around named projects. The vulnerability resides in list-project-files-validation-factory.ts, a validation factory responsible for sanitizing the projectName parameter before it is used to construct file system paths when listing project files. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause: the projectName input is not adequately validated or canonicalized prior to path construction, allowing traversal sequences such as ../../ to escape the intended project directory root. The CPE cpe:2.3:a:alioshr:memory-bank-mcp:*:*:*:*:*:*:*:* covers all versions up to and including the reported ceiling. The version description references both 0.2.1 and 3.1, which may indicate two distinct versioning lineages or a package rename, introducing some ambiguity into the exact affected range.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer had not responded to the coordinated disclosure as of the reporting date. Operators should monitor the GitHub repository (https://github.com/alioshr/memory-bank-mcp/) and VulDB entry (https://vuldb.com/cve/CVE-2026-15524) for any released fix. As compensating controls: restrict local system access to the host running memory-bank-mcp to only explicitly trusted users, eliminating the pool of potential exploiters at the OS level; run the MCP server process under a dedicated least-privilege service account whose filesystem access is scoped to the project directories via OS-enforced controls such as a chroot jail, Linux namespaces, or mandatory access control profiles (AppArmor or SELinux), which would contain traversal reach to the service account's permitted paths at the cost of additional operational configuration complexity; and audit any existing projectName inputs in logs for traversal patterns (../, ..%2F) to detect prior abuse attempts. None of these mitigations eliminate the root cause in the application code.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today