CVE-2026-7599

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was detected in Dayoooun hwpx-mcp 0.2.0. This affects the function save_document/export_to_text/export_to_html of the file mcp-server/src/index.ts of the component MCP Interface. Performing a manipulation of the argument output_path results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 1, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-759908.6Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the currCVE-2026-759918.6Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-759927.8Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current CVE-2026-759938.5ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicCVE-2026-759949.6ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-759958.4ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the curCVE-2026-759967.5ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker cCVE-2026-759987.5ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit CVE-2026-759998.4ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the curCVE-2026-76006.3A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/indeCVE-2026-760006.5ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker cCVE-2026-760017.1ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged att