Path Traversal Vulnerability in MCPVault by Bitbonsai
CVE-2026-57442
What is CVE-2026-57442?
MCPVault, a Model Context Protocol server designed for safe access to files in an Obsidian vault, has a vulnerability in its PathFilter component prior to version 0.11.5. This issue arises because the filtering mechanism uses root-anchored deny-list patterns, leading to insufficient restrictions on nested directories such as .git, .obsidian, and node_modules. An attacker who can manipulate a path selected by an AI agent may exploit this flaw to traverse through these nested directories, potentially gaining unauthorized access to sensitive repository files, remote URLs, or embedded tokens. Additionally, the exploitation could result in the pollution of the listAllTags index with unwanted content from nested node_modules. Upgrading to version 0.11.5 addresses this vulnerability.
Affected Version(s)
mcpvault < 0.11.5