CVE-2026-7159

Vulnerability

Overview

A path traversal vulnerability has been identified in the read_document and list_documents functions of the server.py file in the douinc mkdocs-mcp-plugin, affecting versions up to 0.4.1 [1]. By manipulating the docs_dir and file_path arguments, an attacker can traverse directories outside the intended root and access arbitrary files on the server.

Exploitation

The attack can be carried out remotely without any prior authentication, as the plugin's server interface exposes these functions over the network [1]. An attacker simply needs to craft a request with path traversal sequences (e.g., ../) in the file path parameter to read files outside the intended document root.

Impact

Successful exploitation allows an attacker to read sensitive files from the server file system, potentially including configuration files, credentials, or source code. This could lead to further compromise of the system or application [1].

Mitigation

The vendor has acknowledged the vulnerability and states that a fix will be published within a few days [1]. Until a patch is released, users should consider restricting network access to the plugin's server, or disabling the read_document/list_documents endpoints if not required.