CVE-2026-57441: MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or nodemodules pass both isAllowed() and isAllowedForListing() even though the operating system opens the restricted directory, and Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can use the bypass in read, write, move, search, or listing operations to expose or modify sensitive repository and Obsidian metadata. Vault-root .. containment is not affected. This issue is fixed in version 0.11.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCPVaultto a version that resolves this vulnerability.Fixed in 0.11.4
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
MCPVault versions before 0.11.4 are exposed when the vault is on a case-insensitive macOS or Windows filesystem. Windows systems are also affected by path segments with trailing dots or spaces.
What must an attacker be able to do to exploit it?
The attacker must be able to influence a path selected by an AI agent. They can use case variants of restricted directory names, or on Windows names with trailing dots or spaces, to bypass the PathFilter deny-list.
What operations can be abused after bypassing the filter?
The bypass applies to read, write, move, search, and directory-listing operations. It can expose or modify content in .git, .obsidian, or node_modules directories.
Does this allow traversal outside the vault root?
No. Vault-root .. containment is not affected by this issue.
What is the available remediation?
Upgrade MCPVault to version 0.11.4, which fixes the issue.