CVE-2026-15138

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15138

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15138.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15138

Published

2026-07-09T00:15:08.654Z

Modified

2026-07-15T01:49:14.864699253Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

tumf mcp-text-editor text_editor.py _validate_file_path path traversal

Details

A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function validatefilepath of the file mcptexteditor/texteditor.py. Such manipulation of the argument file_path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor closed the GitHub issue for this vulnerability without any explanation.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15138.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.1"
                },
                {
                    "last_affected": "1.0.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/tumf/mcp-text-editor

Affected ranges

Type

GIT

Repo

https://github.com/tumf/mcp-text-editor

Events

Introduced

aca2fb415486044874c2fab6f856a58fee4ef3f9

Last affected

306162a2c7f8ffd438ab186aafae9715e336fe37

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.0

1.0.2

v1.*

v1.0.0

v1.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15138.json"