CVE-2026-15524
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A security vulnerability in alioshr memory-bank-mcp up to version 0.2.1/3.1 allows path traversal via the projectName argument in list-project-files-validation-factory.ts. Local access is required, and the exploit has been publicly disclosed.
Risk Assessment
The organization risks unauthorized file access outside the intended project directory, potentially leading to data leakage or system compromise.
Recommendation
Immediately update memory-bank-mcp to the latest available version or implement input validation for the projectName argument as a temporary mitigation.
Original NVD description (English source)
A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-factory.ts. Such manipulation of the argument projectName leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.