GHSA-wfr3-hf93-qgg3

Source

https://github.com/advisories/GHSA-wfr3-hf93-qgg3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-wfr3-hf93-qgg3/GHSA-wfr3-hf93-qgg3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wfr3-hf93-qgg3

Aliases

CVE-2026-7159
PYSEC-2026-2653

Published

2026-04-28T00:31:40Z

Modified

2026-07-13T16:42:26Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

mkdocs-mcp-plugin has a Path Traversal issue

Details

A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read_document/list_documents of the file server.py. Performing a manipulation of the argument docs_dir/file_path results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor confirms, that the "fix will be published within a few days."

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-06T19:02:37Z",
    "nvd_published_at":  "2026-04-27T22:16:18Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / mkdocs-mcp-plugin

Package

Name: mkdocs-mcp-plugin; View open source insights on deps.dev
Purl: pkg:pypi/mkdocs-mcp-plugin

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.4.1

Affected versions

0.*

0.1.0

0.3.0

0.4.0

0.4.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-wfr3-hf93-qgg3/GHSA-wfr3-hf93-qgg3.json"