Insecure File Path Handling in Model Context Protocol Servers
CVE-2026-27735

6.4MEDIUM

Key Information:

Vendor

Modelcontextprotocol

Status
Servers
Vendor
CVE Published:
25 February 2026

What is CVE-2026-27735?

The Model Context Protocol Servers introduce a vulnerability in the git_add tool which fails to validate file paths specified in the files argument. This oversight allows paths containing ../ sequences to access files outside the intended repository, potentially leading to unauthorized modifications. Users running versions prior to 2026.1.14 are highly recommended to upgrade to the latest version to effectively secure their systems. Affected users should ensure their systems adhere to proper repository boundaries to prevent exploit attempts.

Affected Version(s)

servers < 2026.1.14

References

https://github.com/modelcontextprotocol/servers/security/...
x_refsource_CONFIRM
https://github.com/modelcontextprotocol/servers/pull/3164
x_refsource_MISC

CVSS V4

Score:
6.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.