CVE-2026-86439: knowns before 0.30.0 Path Traversal via MCP doc and memory tools
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCP doc and memory toolsto a version that resolves this vulnerability.Fixed in 0.30.0 - Configuration
Upgrade to a version that validates filesystem paths in MCP tool arguments (mentioned as fixing the issue in versions before 0.30.0). Ensure path arguments fail when they contain directory traversal sequences and cannot access files outside the project directory.
MCP tool arguments filesystem path validation = enabled (validate filesystem paths in MCP tool arguments)
Event History
Frequently Asked Questions
Which versions require remediation?
knowns versions before 0.30.0 are affected. Upgrade to 0.30.0 or later.
What access does an attacker need?
The attacker needs low-level privileges and the ability to supply arguments to the MCP document or memory tools. No user interaction is required.
What files can be affected?
The issue can affect Markdown files outside the project directory when they are accessible to the knowns server process. An attacker may be able to read, create, overwrite, or delete those files.