CVE-2026-7314

HighCVSS 7.3/10Last modified Jul 24, 2026

Description

A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get_doc_path of the file src/spire_doc_mcp/api/base.py. Performing a manipulation of the argument document_name results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-731405.3Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although norm CVE-2026-73157.3A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get_pdf_path of the file src/spire_pdf_mcp/server.py CVE-2026-731555.3Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether tho CVE-2026-731565.3Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. S CVE-2026-731572.3Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolatio CVE-2026-731585.1Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties CVE-2026-731595.1Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper m CVE-2026-73167.3A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an unknown function of CVE-2026-731608.7Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL valid CVE-2026-731615.1Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight()CVE-2026-731625.3Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /CVE-2026-731638.6Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera