CVE-2026-7315
Description
A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get_pdf_path of the file src/spire_pdf_mcp/server.py of the component PDF File Handler. Executing a manipulation of the argument filepath can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A path traversal vulnerability in eiceblue spire-pdf-mcp-server 0.1.1 allows remote attackers to read, create, or convert arbitrary PDF files outside the intended directory.
Vulnerability in
get_pdf_path() in src/spire_pdf_mcp/server.py allows path traversal. The function returns absolute paths unchanged and joins relative paths to PDF_FILES_PATH without normalization or containment checks [1]. This enables attackers to escape the configured PDF directory using payloads like ../../../../tmp/poc.pdf or /tmp/poc.pdf [1].
Attackers can exploit this remotely by sending crafted filepath arguments to exposed tools such as create_pdfdocument and convert_pdfdocument [1][2]. No authentication is required; the server listens on a configurable port (default 8000) and integrates with AI agents via MCP [2].
Impact includes arbitrary PDF file creation, conversion to attacker-chosen output locations, and reading of any host PDF accessible to the service account [1]. The vulnerability has been publicly disclosed with a proof-of-concept [1].
As of the report date (April 10, 2026), the vendor has not responded or released a fix [1]. Users should restrict network access to the server and avoid exposing it to untrusted networks until a patch is available.
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: = 0.1.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.