Description
A flaw has been found in WilliamCloudQi matlab-mcp-server up to ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca. The affected element is the function generate_matlab_code/execute_matlab_code of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument scriptPath can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-04-28
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the execute_matlab_code function of the WilliamCloudQi matlab-mcp-server component. By manipulating the scriptPath argument supplied to this function, an attacker can perform a directory traversal, potentially allowing access to files outside the intended directory. This flaw may enable an attacker to read or modify sensitive files on the server, which could lead to compromise of the application. The issue is identified as a Path Traversal weakness (CWE‑22).

Affected Systems

WilliamCloudQi matlab-mcp-server, any deployment that includes code up to commit ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate to high severity. The flaw is exploitable remotely, and published exploits are available. No EPSS score is present and the issue is not listed in CISA KEV. Based on the description, it is inferred that the attack vector involves supplying a crafted scriptPath parameter to the execute_matlab_code endpoint, enabling path traversal on the server.

Generated by OpenCVE AI on April 28, 2026 at 23:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply an updated version of matlab-mcp-server that includes a fix once it becomes available.
  • Modify the server code to validate and sanitize the scriptPath argument, rejecting or normalizing traversal sequences such as ".." and ensuring the path resolves within a trusted base directory.
  • Enforce authentication and authorization on the execute_matlab_code endpoint, restricting access to privileged users or disabling the function if it is not needed.

Generated by OpenCVE AI on April 28, 2026 at 23:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Apr 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Williamcloudqi
Williamcloudqi matlab-mcp-server
Vendors & Products Williamcloudqi
Williamcloudqi matlab-mcp-server

Tue, 28 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Apr 2026 13:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in WilliamCloudQi matlab-mcp-server up to ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca. The affected element is the function generate_matlab_code/execute_matlab_code of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument scriptPath can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title WilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal
Weaknesses CWE-22
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Williamcloudqi Matlab-mcp-server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-28T14:14:11.969Z

Reserved: 2026-04-28T05:42:46.158Z

Link: CVE-2026-7272

cve-icon Vulnrichment

Updated: 2026-04-28T14:14:07.883Z

cve-icon NVD

Status : Deferred

Published: 2026-04-28T14:16:14.890

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-7272

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T10:10:47Z

Weaknesses