The vulnerability CVE-2026-7314 affects eiceblue spire-doc-mcp-server 1.0.0. It arises from insufficient validation of the document_name parameter in the get_doc_path function, enabling path traversal attacks. An attacker can remotely manipulate this parameter to access files outside the intended directory scope. The vulnerability is publicly known and exploitable without any privileges or user interaction. No vendor response or patch has been issued as of the publication date.

Successful exploitation allows an attacker to read arbitrary files on the server hosting spire-doc-mcp-server, potentially exposing sensitive information. Since the attack requires no authentication and can be performed remotely, the risk of unauthorized data disclosure is significant. However, the vulnerability does not indicate privilege escalation or code execution capabilities based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing temporary mitigations such as restricting network access to the affected service or employing web application firewalls to detect and block path traversal attempts. Monitor official vendor channels for updates and apply patches promptly once available.