Is there a public PoC exploit available for EUVD-2026-18202?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18202. Prioritise patching immediately. EPSS: 0.9%.

Fast Filesystem Mcp EUVD-2026-18202

Q: What is the CVSS score of EUVD-2026-18202?

EUVD-2026-18202 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-5327 LOW

Command Injection (CWE-77)

2026-04-02 VulDB

Command Injection Fast Filesystem Mcp

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 12:00 euvd

EUVD-2026-18202

Analysis Generated

Apr 02, 2026 - 12:00 vuln.today

CVE Published

Apr 02, 2026 - 11:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in efforthye fast-filesystem-mcp up to 3.5.1. The affected element is the function handleGetDiskUsage of the file src/index.ts. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Command injection in efforthye fast-filesystem-mcp up to version 3.5.1 allows authenticated remote attackers to execute arbitrary system commands via the handleGetDiskUsage function in src/index.ts. The vulnerability has a CVSS score of 6.3 (medium) with publicly available exploit code and no vendor patch released despite early notification through issue tracking. Exploitation requires valid authentication credentials but carries low attack complexity.

Technical ContextAI

The vulnerability stems from improper input validation in the handleGetDiskUsage function, classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The affected product is efforthye fast-filesystem-mcp, a fast filesystem implementation accessed via the Model Context Protocol (MCP). The command injection occurs when user-supplied input is concatenated into shell commands without proper escaping or parameterization. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible attack surface with low attack complexity, but requires authenticated user privileges (PR:L). The E:P flag in the environmental metrics confirms public exploit availability.

RemediationAI

No vendor-released patch identified at time of analysis. The project maintainer was notified early via GitHub issue (https://github.com/efforthye/fast-filesystem-mcp/issues/15) but has not responded with a fix. Organizations currently deploying fast-filesystem-mcp should immediately implement access controls to restrict usage to trusted, authenticated users only. Monitor the official GitHub repository (https://github.com/efforthye/fast-filesystem-mcp/) for security updates. As an interim mitigation, disable or restrict access to the handleGetDiskUsage endpoint if not operationally required, or implement web application firewall rules to detect and block command injection patterns in requests. Consider evaluating alternative filesystem implementations with active security maintenance. Users should avoid updating to versions 3.5.1 or earlier until a patched release becomes available.