CVE-2026-81486

MediumCVSS 5.3/10Last modified Aug 28, 2026

Description

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_context of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2026
Last modified: Aug 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-81495.1A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the Bouncy Castle Inc. B CVE-2026-814907.7A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop fun CVE-2026-814917.3A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_CVE-2026-815057.1Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes CVE-2026-815076.5ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid CVE-2026-815084.3ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp CVE-2026-81515.4The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers CVE-2026-815157.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 unti CVE-2026-815167.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 unti CVE-2026-815177.5An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection lo CVE-2026-815187.5When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake b CVE-2026-81529.3Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spa