EUVD-2026-66835
GHSA-cfj4-56c7-w9x6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth required per CVSS 4.0 PR:N; partial file read/write impact; no availability impact directly attributable to traversal alone.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_folder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in boxpositron/with-context-mcp up to version 3.0.7 exposes the host filesystem through four note-management functions - ingest_notes, teleport_notes, sync_notes, and project_folder - in src/index.ts, allowing unauthenticated remote attackers to read or write files outside the intended working directory. The affected package is a Model Context Protocol (MCP) server, meaning exploitation is triggered via tool-call requests sent to the MCP endpoint, a vector inherently accessible to any AI agent or client connected to the server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The MCP server process must be reachable over the network (AV:N per CVSS 4.0 vector); no authentication is required (PR:N) and no user interaction is needed (UI:N), meaning any client that can reach the MCP endpoint can trigger the traversal. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.9 (vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:L and E:P) reflects a moderately severe, unauthenticated network-accessible path traversal with a publicly available proof-of-concept. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to the MCP server's network endpoint sends a crafted tool-call request to one of the vulnerable functions - for example, invoking ingest_notes with a filename parameter containing path traversal sequences such as '../../../../etc/passwd' - causing the server to read and return the content of an arbitrary host file. Because a proof-of-concept has been published via the GitHub issue, the technique is publicly documented and requires no specialized knowledge. … |
| Remediation | No vendor-released patch has been identified at time of analysis; the project maintainer had not responded to the GitHub issue disclosure as of the report date. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today