Is there a public PoC exploit available for CVE-2026-7728?

Yes, a public proof-of-concept exploit is available for CVE-2026-7728. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-7728?

Yes, a patch is available for CVE-2026-7728. Update the affected software to the latest version immediately.

mcp-rtfm CVE-2026-7728

Q: What is the CVSS score of CVE-2026-7728?

CVE-2026-7728 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26882 LOW

Path Traversal (CWE-22)

2026-05-04 VulDB

Path Traversal

2.1

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 04, 2026 - 15:18 vuln.today

Public exploit code

Severity Changed

May 04, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 04, 2026 - 05:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

May 04, 2026 - 05:00 vuln.today

Analysis Generated

May 04, 2026 - 05:00 vuln.today

EUVD ID Assigned

May 04, 2026 - 04:30 euvd

EUVD-2026-26882

Analysis Generated

May 04, 2026 - 04:30 vuln.today

Patch released

May 04, 2026 - 04:30 nvd

Patch available

CVE Published

May 04, 2026 - 03:30 nvd

LOW 2.1

DescriptionNVD

A vulnerability was identified in ryanjoachim mcp-rtfm 0.1.0. This vulnerability affects the function get_doc_content/read_doc/update_doc of the component MCP Interface. Such manipulation of the argument docFile leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e6f0686fc36012f78236e7fed172c81444904b0b. It is best practice to apply a patch to resolve this issue.

AnalysisAI

Path traversal in ryanjoachim mcp-rtfm 0.1.0 allows authenticated remote attackers to read, write, and delete arbitrary files by manipulating the docFile parameter in the get_doc_content, read_doc, update_doc, and related MCP interface functions. Publicly available exploit code exists, and the vulnerability affects all versions of the product without a patched release identifier provided. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-7728 vulnerability details – vuln.today

Back