Mcp Sequential Thinking
Monthly
Path traversal in arben-adm mcp-sequential-thinking versions up to and including 0.5.0 allows remote low-privileged attackers to read or write arbitrary files on the server by supplying unsanitized path sequences to the `import_session` and `export_session` functions in `server.py`. A publicly disclosed proof-of-concept exists (GitHub issue #17), and the fix is available in v0.6.0 via commit 2fad3ee8. The CVE is not listed in CISA KEV, indicating no confirmed mass exploitation, but the public PoC meaningfully elevates practical risk above the moderate CVSS score alone.
Path traversal in arben-adm mcp-sequential-thinking versions up to and including 0.5.0 allows remote low-privileged attackers to read or write arbitrary files on the server by supplying unsanitized path sequences to the `import_session` and `export_session` functions in `server.py`. A publicly disclosed proof-of-concept exists (GitHub issue #17), and the fix is available in v0.6.0 via commit 2fad3ee8. The CVE is not listed in CISA KEV, indicating no confirmed mass exploitation, but the public PoC meaningfully elevates practical risk above the moderate CVSS score alone.