AI agent vulnerability · Other MCP servers and tools

CVE-2026-7159: mkdocs-mcp-plugin has a Path Traversal issue

mediumCVSS 4.0 5.5 · 3.1 7.3GHSA-wfr3-hf93-qgg3

A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function readdocument/listdocuments of the file server.py. Performing a manipulation of the argument docsdir/filepath results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor confirms, that the "fix will be published within a few days."

Published Apr 28, 2026 · Updated May 6, 2026

Affected packages

mkdocs-mcp-plugin

Ecosystem: PyPI
Affected: <= 0.4.1
Fixed in: No patched version yet
Check: pip show mkdocs-mcp-plugin

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read_document/list_documents of the file server.py. Performing a manipulation of the argument docs_dir/file_path results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor confirms, that the "fix will be published within a few days."

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries