CVE-2026-7315

EUVD-2026-26152 MEDIUM

Path Traversal (CWE-22)

2026-04-28 cna@vuldb.com

Path Traversal

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:06 vuln.today

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 22:22 euvd

EUVD-2026-26152

CVE Published

Apr 28, 2026 - 22:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get_pdf_path of the file src/spire_pdf_mcp/server.py of the component PDF File Handler. Executing a manipulation of the argument filepath can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in eiceblue spire-pdf-mcp-server 0.1.1 allows unauthenticated remote attackers to escape the intended PDF directory by supplying crafted traversal sequences in the filepath argument to the get_pdf_path function, enabling unauthorized read and write access to arbitrary files on the host. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions, and a published exploit is confirmed (E:P). No vendor patch is available; the project maintainer has not responded to the responsible disclosure filed in GitHub issue #1.