CVE-2026-7212

Vulnerability

Overview

CVE-2026-7212 is a path traversal vulnerability in edvardlindelof's notes-mcp server up to version 0.1.4. The flaw resides in notes_mcp.py, where file operations (read, write, mkdir, rm, rmdir) construct paths by concatenating the user-supplied path argument with the configured root_dir using root_dir / path without any resolution or boundary check [1][2]. This allows an attacker to inject ../ sequences to escape the intended notes vault.

Exploitation

An attacker who can invoke any of the MCP tools (e.g., through a connected LLM chatbot or direct network access) can supply a path containing ../ to read, write, create, or delete files outside the root_dir [1]. The attack is remotely exploitable as the MCP server is typically exposed to network clients [4]. No authentication is required beyond the ability to call the tools.

Impact

Successful exploitation enables arbitrary file read (exfiltration of sensitive data), arbitrary file write (potential code injection or configuration modification), and arbitrary file deletion (denial of service) on the host filesystem [1]. The impact is limited only by the permissions of the user running the notes-mcp server.

Mitigation

As of the public disclosure date (April 2026), the vendor has not responded to the issue report and no patch is available [1][4]. Users should restrict network access to the MCP server, implement a reverse proxy with path validation, or avoid using the affected versions until a fix is released.