Path Traversal Vulnerability in Tumf MCP Text Editor Affects Version Up to 1.0.2
CVE-2026-15138

5.3MEDIUM

Key Information:

Vendor: Tumf
Status: Mcp-text-editor
Vendor: CVE Published:; 9 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15138?

A security vulnerability has been identified in Tumf's MCP Text Editor, specifically in the _validate_file_path function found in text_editor.py. This vulnerability allows an attacker to perform path traversal by manipulating the 'file_path' argument, potentially gaining unauthorized access to sensitive files on the server. The issue has been disclosed publicly, making it accessible for exploitation, and the vendor has closed the associated GitHub issue without clarifying further actions.

Affected Version(s)

mcp-text-editor 1.0.0

mcp-text-editor 1.0.1

mcp-text-editor 1.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15138 - Proof of Concept