EUVD-2026-25926Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth, no interaction; confidentiality impact only, as description confirms read operations with no evidence of write or denial-of-service primitives.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read_document/list_documents of the file server.py. Performing a manipulation of the argument docs_dir/file_path results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor confirms, that the "fix will be published within a few days."
AnalysisAI
Path traversal in douinc mkdocs-mcp-plugin 0.4.0 and 0.4.1 exposes arbitrary server filesystem files to remote unauthenticated attackers via unsanitized docs_dir and file_path arguments in the read_document and list_documents functions of server.py. A public proof-of-concept is available on GitHub (issue #6), and SSVC classifies the attack as automatable, lowering the bar for mass exploitation. No patched version has been released at time of analysis; the vendor has acknowledged the issue and committed to publishing a fix within days.
Technical ContextAI
mkdocs-mcp-plugin is a Python plugin for MkDocs that exposes a Model Context Protocol (MCP) server interface, enabling AI clients to programmatically read and list documentation files hosted by the server. The vulnerable code in server.py accepts user-supplied docs_dir and file_path parameters in the read_document and list_documents functions without adequate path canonicalization or confinement to the intended documentation root. This is a classic CWE-22 (Path Traversal) defect: an attacker can embed sequences such as '../../' in these arguments to escape the docs directory and resolve arbitrary filesystem paths accessible to the server process. The affected product is identified under CPE cpe:2.3:a:douinc:mkdocs-mcp-plugin:*:*:*:*:*:*:*:*, covering all releases through 0.4.1. Because the plugin operates as a network-facing MCP server, exploitation requires no local access.
RemediationAI
No vendor-released patched version has been confirmed at time of analysis. The vendor acknowledged the issue via the GitHub repository and stated a fix will be published within a few days - monitor https://github.com/douinc/mkdocs-mcp-plugin/ and the VulDB entry at https://vuldb.com/vuln/359758 for a tagged release. As an immediate compensating control, restrict network access to the MCP server endpoint to trusted hosts only using firewall rules or reverse-proxy allowlisting - this is the most effective interim measure, though it will block legitimate remote MCP clients. A second option is to run the plugin in a sandboxed container with a read-only volume mount scoped strictly to the documentation directory, limiting path traversal reach to only intended content; the trade-off is added operational complexity. Once a patched release is available, upgrade immediately and verify the fix confines file resolution to the docs root before removing compensating controls.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today