CVE-2026-7384

ezequiroga mcp-bases research_server.py search_papers path traversal

View on CVE.org
Published Apr 29, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in ezequiroga mcp-bases 357ca19c7a49a9b9cb2ef639b366f03aba8bea39/c630b8ab0f970614d42da8e566e9c0d15a16414c. This impacts the function search_papers of the file research_server.py. Performing a manipulation of the argument topic results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

A path traversal flaw exists in the search_papers function of research_server.py. By manipulating the topic argument, an attacker can read files outside the intended directory. Remote exploitation is possible, meaning an attacker can reach the vulnerable function over the network and gain unauthorized access to sensitive files, potentially leading to further compromise if executable files are read.

Affected Systems

The vulnerability affects ezequiroga’s mcp-bases project. No specific version numbers are listed because the project follows a rolling release model, so all current releases are potentially impacted until a patch is provided.

Risk and Exploitability

The CVSS score of 6.9 reflects a moderate to high risk. EPSS data is unavailable, and the vulnerability has not yet been listed in CISA’s KEV catalog. Attackers likely need to send crafted requests to the research_server.py endpoint, and success depends on the exposed API surface and lack of input validation. Because the issue is publicly documented and no response from the maintainer has been received, the risk of exploitation remains significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the currently deployed commit of mcp-bases and determine if the vulnerable code path exists; if a newer commit addresses the issue, update to that commit immediately.
  • Implement input validation for the topic parameter by allowing only a defined whitelist of characters or by resolving paths relative to a safe base directory before use, to eliminate the effect of the path traversal.
  • Configure a web application firewall or similar controls to block requests containing traversal sequences such as "../" or absolute paths in the topic field.
  • Consider temporarily disabling the search_papers endpoint or restricting its access to trusted users until the vulnerability can be fixed.

Generated by OpenCVE AI on April 29, 2026 at 16:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Ezequiroga
Ezequiroga mcp-bases
Vendors & Products Ezequiroga
Ezequiroga mcp-bases
Type Values Removed Values Added
Description A vulnerability was detected in ezequiroga mcp-bases 357ca19c7a49a9b9cb2ef639b366f03aba8bea39/c630b8ab0f970614d42da8e566e9c0d15a16414c. This impacts the function search_papers of the file research_server.py. Performing a manipulation of the argument topic results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Title ezequiroga mcp-bases research_server.py search_papers path traversal
Weaknesses CWE-22
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 29, 2026, 2:40 PM
Reserved
Apr 29, 2026, 8:45 AM

View source JSON

Updated
Apr 29, 2026, 2:40 PM

JSON

Status
Deferred
Published
Apr 29, 2026, 3:16 PM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
Apr 30, 2026, 8:21 AM

JSON