CVE-2026-81491: boxpositron with-context-mcp index.ts project_folder path traversal
A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of boxpositron with-context-mcp up to version 3.0.7 are affected. The issue is in the project_folder handling used by ingest_notes, teleport_notes, and sync_notes in src/index.ts.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
Is public exploit information available?
Yes. An exploit has been published and may be used, increasing the urgency of assessing exposed instances.
Is a vendor fix available?
The provided information does not identify a fixed version. It states that the project was notified through an issue report but had not responded at the time of publication.