EUVD-2026-26238Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or complexity; impact is partial file read/write bounded by process permissions; availability impact not confirmed by description alone.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was detected in ezequiroga mcp-bases 357ca19c7a49a9b9cb2ef639b366f03aba8bea39/c630b8ab0f970614d42da8e566e9c0d15a16414c. This impacts the function search_papers of the file research_server.py. Performing a manipulation of the argument topic results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in ezequiroga/mcp-bases search_papers function allows unauthenticated remote attackers to read and potentially write files outside the intended directory by supplying crafted ../ sequences in the topic argument to research_server.py. Two specific commits (357ca19 and c630b8a) are confirmed affected; the project's rolling release model means no versioned fix exists and the maintainer had not responded to disclosure at time of reporting. A public proof-of-concept exploit is available via GitHub, and SSVC rates exploitation as automatable with partial technical impact - a notable combination despite the low EPSS of 0.05%.
Technical ContextAI
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes a root cause where user-controlled input is concatenated into a filesystem path without stripping traversal sequences such as ../. In this case, the search_papers function in research_server.py accepts a topic parameter that is unsanitized before being used in a path operation, allowing an attacker to escape the intended research directory. The affected product is an MCP (Model Context Protocol) server - a class of software designed to expose callable tools to AI assistants - meaning it may be deployed in automated, programmatically-driven pipelines with network exposure. CPE: cpe:2.3:a:ezequiroga:mcp-bases:*:*:*:*:*:*:*:*. No version-pinned releases exist; the affected surface spans at least commits 357ca19c and c630b8ab.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer had not responded to the responsible disclosure reported via GitHub issue #2 (https://github.com/ezequiroga/mcp-bases/issues/2). As an immediate compensating control, restrict the filesystem access of the process running mcp-bases using OS-level isolation: deploy inside a Docker container with only the necessary read-only bind-mounts, or apply a chroot/seccomp profile limiting accessible paths. This limits traversal reach but does not eliminate the vulnerability. Additionally, placing a WAF or reverse proxy in front of the MCP endpoint to reject requests where the topic parameter contains ../, ..%2F, or encoded traversal sequences can block known exploit patterns, though bypasses may exist. Avoid exposing the research_server.py endpoint to untrusted networks until a fix is available. Monitor https://github.com/ezequiroga/mcp-bases/ and the VulDB entry at https://vuldb.com/vuln/360106 for upstream remediation activity.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today