EUVD-2026-26156Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no auth or complexity barriers; confidentiality and integrity partially impacted via arbitrary file read/write; no direct availability impact from traversal alone.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in elinsky execution-system-mcp 0.1.0. The impacted element is the function _get_context_file_path of the file src/execution_system_mcp/server.py of the component add_action Tool. This manipulation of the argument context causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used.
AnalysisAI
Path traversal in elinsky's execution-system-mcp 0.1.0 allows remote unauthenticated attackers to escape the intended directory boundary by manipulating the context argument passed to the _get_context_file_path function via the add_action tool, enabling read and potential write access to arbitrary files on the host filesystem. A public proof-of-concept exploit is confirmed (GitHub issue #1, VulDB 359972), and SSVC classifies the attack as automatable with partial technical impact. Despite EPSS at 0.08% reflecting the product's obscurity, the no-auth network-exploitable attack surface means any exposed instance faces meaningful risk.
Technical ContextAI
execution-system-mcp is a Python-based Model Context Protocol (MCP) server implementation by GitHub user elinsky, exposing an add_action tool via src/execution_system_mcp/server.py. The vulnerable function _get_context_file_path accepts a caller-controlled context argument and uses it to construct a filesystem path without adequate sanitization or canonical-path enforcement. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) identifies the root cause: sequences such as ../../ in the context value traverse upward from the server's working directory, resolving to arbitrary locations accessible by the server process. No CPE string was provided; affected version is confirmed as execution-system-mcp 0.1.0 per EUVD-2026-26156.
RemediationAI
No vendor-released patched version has been confirmed at time of analysis - the only referenced release is 0.1.0. Monitor the upstream repository at https://github.com/elinsky/execution-system-mcp/ and the VulDB advisory at https://vuldb.com/vuln/359972 for a fix. As an immediate compensating control, restrict network access to the MCP server to trusted callers only (firewall rules or network segmentation), since the vulnerability requires network reachability. In code, the _get_context_file_path function should resolve the supplied path to its canonical form (e.g., Python's os.path.realpath) and assert it falls within the permitted base directory before any file operation - this eliminates the traversal without disabling the feature. If immediate patching is not feasible, disabling the add_action tool endpoint entirely eliminates the attack surface but removes associated functionality. Running the server process under a restricted OS user account limits the blast radius of successful exploitation to files that account can access.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today