PYSEC-2026-2653

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/mkdocs-mcp-plugin/PYSEC-2026-2653.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-2653
Aliases
Published
2026-07-13T15:02:54Z
Modified
2026-07-13T16:31:51Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
mkdocs-mcp-plugin has a Path Traversal issue
Details

A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read_document/list_documents of the file server.py. Performing a manipulation of the argument docs_dir/file_path results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor confirms, that the "fix will be published within a few days."

References

Affected packages

PyPI / mkdocs-mcp-plugin

Package

Name
mkdocs-mcp-plugin
View open source insights on deps.dev
Purl
pkg:pypi/mkdocs-mcp-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.4.1

Affected versions

0.*
0.1.0
0.3.0
0.4.0
0.4.1

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/mkdocs-mcp-plugin/PYSEC-2026-2653.yaml"