Mkdocs Mcp Plugin
Monthly
Path traversal in douinc mkdocs-mcp-plugin 0.4.0 and 0.4.1 exposes arbitrary server filesystem files to remote unauthenticated attackers via unsanitized docs_dir and file_path arguments in the read_document and list_documents functions of server.py. A public proof-of-concept is available on GitHub (issue #6), and SSVC classifies the attack as automatable, lowering the bar for mass exploitation. No patched version has been released at time of analysis; the vendor has acknowledged the issue and committed to publishing a fix within days.
Path traversal in douinc mkdocs-mcp-plugin 0.4.0 and 0.4.1 exposes arbitrary server filesystem files to remote unauthenticated attackers via unsanitized docs_dir and file_path arguments in the read_document and list_documents functions of server.py. A public proof-of-concept is available on GitHub (issue #6), and SSVC classifies the attack as automatable, lowering the bar for mass exploitation. No patched version has been released at time of analysis; the vendor has acknowledged the issue and committed to publishing a fix within days.