EUVD-2026-26250Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, no interaction; partial C/I/A bounded by server process permissions; no scope change as impact stays within the MCP server's own filesystem context.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A flaw has been found in fatbobman mail-mcp-bridge up to 1.3.3. Affected is an unknown function of the file src/mail_mcp_server.py. Executing a manipulation of the argument message_ids can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3.4 is able to address this issue. This patch is called 638b162b26532e32fa8d8047f638537dbdfe197a. Upgrading the affected component is recommended.
AnalysisAI
Path traversal in fatbobman mail-mcp-bridge versions 1.3.0 through 1.3.3 exposes arbitrary filesystem paths to remote unauthenticated attackers via unsanitized message_ids arguments in the MCP server's attachment management functions. The vulnerable code in cleanup_attachments.py and extract_attachments.py directly concatenated email Message-ID values onto a base filesystem path without validation, allowing sequences such as ../../etc to escape the intended attachment directory. A public exploit exists (GitHub issue #2), SSVC rates the attack as automatable, and vendor-released fix version 1.3.4 is available.
Technical ContextAI
mail-mcp-bridge is a Python-based Model Context Protocol (MCP) server (src/mail_mcp_server.py) that manages email attachments on the local filesystem. The root cause (CWE-22) lies in cleanup_attachments.py and extract_attachments.py, where both files constructed attachment directory paths by calling message_id.strip('<>') and then appending the result directly to a base path using Python's Path concatenation operator (base_path / clean_message_id). Because email Message-ID values are external, untrusted input, a crafted value containing ../ sequences resolves outside the intended attachment directory - a textbook path traversal. The fix in commit 638b162b introduces attachment_paths.py, which base64-encodes the message ID into a mid_-prefixed safe directory name and verifies the resolved path stays under the base directory using Path.resolve() and Path.relative_to(). Affected CPE: cpe:2.3:a:fatbobman:mail-mcp-bridge:*:*:*:*:*:*:*:* covering versions through 1.3.3.
RemediationAI
Upgrade to mail-mcp-bridge version 1.3.4, which resolves the path traversal via commit 638b162b26532e32fa8d8047f638537dbdfe197a (https://github.com/fatbobman/mail-mcp-bridge/commit/638b162b26532e32fa8d8047f638537dbdfe197a), available at https://github.com/fatbobman/mail-mcp-bridge/releases/tag/1.3.4. If immediate upgrade is not possible, restrict network-level access to the MCP server endpoint to trusted internal hosts only using firewall rules or network segmentation - this reduces the AV:N exposure to a local-only attack surface but does not eliminate the underlying path handling flaw. Additionally, running the MCP server process under a least-privilege account with read-only access to non-attachment directories limits the impact of a successful traversal; note this adds operational complexity and may interfere with legitimate attachment cleanup operations.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today