Path Traversal Vulnerability in Geldata Gel-MCP 0.1.0
CVE-2026-7403

6.9MEDIUM

Key Information:

Vendor: Geldata
Status: Gel-mcp
Vendor: CVE Published:; 29 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-7403?

A security flaw has been identified in Geldata Gel-MCP version 0.1.0 affecting its fetch_rule function in the server.py file. This vulnerability allows an attacker to exploit the manipulation of the 'rule_name' parameter, potentially leading to unauthorized file access through path traversal. This attack can be executed remotely, and the exploit is already available publicly, posing a significant risk to systems utilizing this software. Despite early notification from an issue report, there has been no response from the project maintainers, furthering the urgency for users to implement mitigating measures.

Affected Version(s)

gel-mcp 0.1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-7403 - Proof of Concept