CVE-2026-7738 Details
Description
A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function create_document/open_document of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
A path traversal vulnerability has been identified in Puchunjie Doc-Tools-MCP version 1.0.18. This vulnerability affects the MCP interface, specifically the 'create_document' and 'open_document' functions. The issue arises because the 'filePath' argument is not properly validated before being passed to file system operations. As a result, an attacker can manipulate the 'filePath' to read from or write to arbitrary locations on the server's file system, particularly targeting Word documents (.docx files). This vulnerability can be exploited remotely, leading to unauthorized data access, integrity issues, and potential disruption of service.
Users are advised to avoid exposing the MCP server to untrusted clients until a fix is available. Access to document read and write tools should be restricted to trusted local users. The MCP server can be run with a low-privilege OS account and in a restricted working directory to mitigate risks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 4, 2026CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/puchunjie/doc-tools-mcp/issues/4 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/BruceJqs/public_exp/issues/38 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://github.com/puchunjie/doc-tools-mcp/ | [email protected] | ProductSource CodeVendor |
| https://github.com/puchunjie/doc-tools-mcp/issues/4 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/807642 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360913 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360913/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| puchunjie doc-tools-mcp | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |