CVE-2026-15138 is a path traversal vulnerability affecting the tumf mcp-text-editor product up to version 1.0.2. The vulnerability resides in the _validate_file_path function within the mcp_text_editor/text_editor.py file. By manipulating the file_path argument, an attacker can perform path traversal attacks remotely, potentially accessing files outside the intended directory scope. Although the vulnerability has been publicly disclosed and exploits may exist, the vendor has not provided any official fix or remediation guidance and closed the related GitHub issue without comment.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to access arbitrary files on the system running the vulnerable mcp-text-editor software. This could lead to information disclosure or further attacks depending on the files accessed. The CVSS 4.0 score of 5.3 reflects a medium severity impact with low attack complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not provided an official fix or mitigation and closed the issue without explanation, users should monitor for updates from the vendor or community. Until a fix is available, consider restricting access to the vulnerable service and validating or sanitizing file path inputs externally if possible.