CVE-2026-81486: bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal
A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability can be exploited remotely with no privileges or user interaction required. Public exploit information is available, increasing the likelihood of attempted exploitation.
What is the impact of successful exploitation?
Successful path traversal through the read_context function can expose file contents outside the intended path. The provided severity metrics indicate a confidentiality impact, with no stated integrity or availability impact.
Is a fix available?
The provided information identifies version 1.0.0 as affected but does not identify a fixed version. The project was notified through an issue report and had not responded at the time of publication.