CVE-2026-81491

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81491
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81491.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81491
Published
2026-08-27T02:15:09.570Z
Modified
2026-08-30T03:30:59.215822260Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
boxpositron with-context-mcp index.ts project_folder path traversal
Details

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81491.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.0.3"
                },
                {
                    "last_affected": "3.0.3"
                }
            ]
        }
    ],
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/boxpositron/with-context-mcp

Affected ranges

Type
GIT
Repo
https://github.com/boxpositron/with-context-mcp
Events
Introduced
30640056dc89b1210776bc1c5c06802fa7f42b9c
Last affected
289e670c3c782409e49b8d0eb20ce116566d9f74
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "3.0.1"
        },
        {
            "last_affected": "3.0.1"
        },
        {
            "introduced": "3.0.2"
        },
        {
            "last_affected": "3.0.2"
        },
        {
            "introduced": "3.0.4"
        },
        {
            "last_affected": "3.0.4"
        },
        {
            "introduced": "3.0.5"
        },
        {
            "last_affected": "3.0.5"
        },
        {
            "introduced": "3.0.6"
        },
        {
            "last_affected": "3.0.6"
        },
        {
            "introduced": "3.0.7"
        },
        {
            "last_affected": "3.0.7"
        }
    ]
}

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.4
3.0.5
3.0.6
3.0.7
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.4
v3.0.5
v3.0.6
v3.0.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81491.json"