CVE-2026-7318
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In elie mcp-project 0.1.0, the search_papers function in research_server.py is vulnerable to path traversal via the topic argument. Local access required, exploit public.
Risk Assessment
Risk of arbitrary file read on the server, including config or sensitive data, potentially leading to privilege escalation.
Recommendation
Immediately disable or secure access to research_server.py. Await official patch from project maintainers.
Original NVD description (English source)
A vulnerability was detected in elie mcp-project 0.1.0. The affected element is the function search_papers of the file research_server.py. The manipulation of the argument topic results in path traversal. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.