EUVD-2026-83780
GHSA-8wj2-8g8v-vcxr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to ACE-MCP server as tool client
-
DeliveryCall get_file_snippet with projectRootPath=/etc
-
ExploitSet filePath to sensitive file
-
ExecutionGuard validates path inside attacker root
-
ImpactRead arbitrary host file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the ability to invoke the ACE-MCP server's get_file_snippet MCP tool (CVSS PR:L - a connected/authorized tool client), after which no user interaction or special product configuration is needed: the attacker fully controls both projectRootPath and filePath arguments and the projectRootPath is treated as trusted. Limiting factors: the attacker must reach the MCP tool endpoint (PR:L, so some client-level access is assumed) and impact is confined to reading files the server process can access; there is no write or code-execution primitive (VI/VA:N). No patch is available, so mitigation depends on restricting access to the MCP server. |
| Impact | Signals are mixed. The vendor (VulDB) CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N yields only 2.1, but that score understates the impact: a path-traversal that reads arbitrary host files (the description confirms projectRootPath=/etc, filePath=hosts bypasses the isPathInsideProjectRoot guard) is arbitrary file disclosure and warrants VC:H, not VC:L - my independent 3.1 assessment is ~6.5 (C:H). Exploitation status: publicly available exploit code exists (GitHub Xh1Xxhg/public_exp issue #3), but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation - POC availability must not be conflated with in-the-wild use. E:P (Proof-of-Concept) in the vendor vector is consistent with a published POC and no confirmed attacks. Net: this is a genuine, easily-exploited authenticated file-read flaw, but real-world priority is dampened by the product's rarity (an obscure hobby MCP server) and the fact that the project has not responded to the issue report, so no patch exists. |
| Exploit ScenarioDerived | An attacker who can send tool calls to the ACE-MCP server (e.g., a malicious or compromised MCP client, or a network-reachable server) invokes get_file_snippet with projectRootPath set to a sensitive root like /etc and filePath set to a target such as hosts, shadow, or an app config, since the guard only checks that filePath stays inside the attacker-supplied root. A public POC exists demonstrating the traversal, making opportunistic reuse trivial for anyone who reaches the endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Path traversal in 0215AndrewFeng ACE-MCP through 4.10.8 lets an authorized MCP tool client read arbitrary files from the host via the get_file_snippet tool: the attacker supplies both projectRootPath and filePath, and because projectRootPath is treated as trusted, setting projectRootPath=/etc with filePath=hosts satisfies the isPathInsideProjectRoot guard and exposes /etc/hosts. Exploitation requires the ability to invoke the MCP server's tool interface (authenticated, CVSS PR:L), needs no user interaction or special server configuration, and yields read-only confidentiality impact (no write or code execution). Publicly available exploit code exists and the issue was reported to the vendor, which has not responded or shipped a fix; the independent assessment rates confidentiality impact High, materially higher than the 2.1 CVSS 4.0 base score in the report, and no CISA KEV entry indicates confirmed active exploitation at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis: the maintainer was notified early via GitHub issue https://github.com/0215AndrewFeng/ACE-MCP/issues/1 and has not responded, so remediation must be compensating controls until a fixed release appears. The most effective control is to stop exposing the MCP server to untrusted callers - bind it to loopback only or place it behind an authenticated gateway, since exploitation requires the ability to invoke the get_file_snippet tool (PR:L); the trade-off is that legitimate remote agent clients lose connectivity until they are routed through the gateway. Run the MCP server process as a dedicated low-privilege account inside a container or chroot with read-only bind mounts limited to the intended project directories, so a traversal read cannot reach /etc, ~/.ssh, cloud credential files, or the server's own secrets; this adds deployment complexity and may break tools that need broader host access. If the code can be forked or patched locally, harden getFileSnippet.ts by discarding the client-supplied projectRootPath in favor of a server-configured allowlisted root and canonicalizing/validating both arguments with realpath before the containment check; disabling or removing the get_file_snippet tool entirely is the simplest stopgap but removes file-snippet functionality for all users. Monitor for anomalous file-read patterns from the MCP process and rotate any credentials that were reachable by the server account, since path traversal reads leave no write-side evidence. Because public exploit code has been published (https://github.com/Xh1Xxhg/public_exp/issues/3), treat internet-exposed or multi-tenant ACE-MCP deployments as high priority for network restriction; no CISA KEV entry confirms active exploitation at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ACE-MCP is a Model Context Protocol (MCP) server that exposes tools to LLM/agent clients; the affected component is the MCP Tool, specifically the get_file_snippet function implemented in getFileSnippet.ts. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal) arises here from a flawed trust boundary rather than a missing canonicalization call alone: the guard isPathInsideProjectRoot verifies that filePath resolves inside projectRootPath, but it never validates projectRootPath itself, which is attacker-supplied client input in the tool invocation. The result is that any path may be selected as the 'root', so the containment check is trivially satisfiable (projectRootPath=/etc, filePath=hosts) and the tool returns the contents of files readable by the MCP server process. The CPE cpe:2.3:a:0215andrewfeng:ace-mcp:*:*:*:*:*:*:*:* confirms this is the ACE-MCP product from GitHub project 0215AndrewFeng/ACE-MCP, with all versions up to and including 4.10.8 in scope. Because the impact is information disclosure (VC:L in the reported CVSS 4.0 vector; C:H with I:N/A:N per the independent CVSS 3.1 assessment), the primary exposure is leakage of configuration files, credentials, tokens, and SSH material reachable by the server's user account.
Know when Ace Mcp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Attacker-controlled projectRootPath yields arbitrary host-file read (C:H), reachable remotely with low-privilege tool access (PR:L, AC:L); no write or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function get_file_snippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. isPathInsideProjectRoot only blocks filePath escaping the attacker-chosen projectRootPath; the root itself is untrusted client input - set projectRootPath=/etc, filePath=hosts and the guard passes. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB