CVE-2026-7205

Vulnerability

Overview

The search_papers() function in src/main.py of duartium papers-mcp-server (commit 9ceb3812a6458ba7922ca24a7406f8807bc55598) contains a path traversal vulnerability (CWE-22). The function uses the user-supplied topic argument to construct a directory path under papers/ by lowercasing the string and replacing spaces with underscores, but it does not sanitize or reject path traversal sequences such as ../. This allows an attacker to escape the intended papers/ storage directory [1].

Exploitation

The vulnerability is exploitable remotely by any client that can invoke the search_papers MCP tool. No authentication is required beyond the ability to send MCP tool calls. The server creates the attacker-controlled directory (via os.makedirs(path, exist_ok=True)) and then writes a papers_info.json file into it. A topic like ../../../../tmp/papers_poc causes the server to create or overwrite /tmp/papers_poc/papers_info.json [1]. The exploit is publicly available, and the project has not yet responded to the issue report [1].

Impact

An attacker can write arbitrary JSON content to any location on the filesystem where the server process has write permissions. This could lead to overwriting critical system files, planting malicious configuration files, or achieving code execution if the written file is later executed or loaded by another component. The impact is limited by the fact that the written file is always named papers_info.json and contains attacker-controlled JSON data [1].

Mitigation

As of the report date (April 10, 2026), no fix has been released. The vendor was informed via a GitHub issue but has not responded [1]. Users should avoid exposing the MCP server to untrusted networks and consider restricting access to the search_papers tool until a patch is available.