The vulnerability CVE-2026-7319 affects elinsky execution-system-mcp version 0.1.0. It is caused by improper handling of the context argument in the _get_context_file_path function of the add_action Tool component, leading to a path traversal condition. This flaw allows an attacker to remotely manipulate file paths, potentially accessing unauthorized files on the system. The vulnerability has been assigned a CVSS 4.0 score of 6.9, reflecting a medium severity level. Although an exploit has been published, there is no vendor advisory or patch available at the time of this report.

Successful exploitation of this vulnerability could allow remote attackers to access files outside the intended directory structure by manipulating the context argument, potentially leading to unauthorized information disclosure or other impacts depending on the accessed files. The CVSS score of 6.9 indicates a medium impact with low attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing access controls or input validation to restrict the context argument to safe values. Monitor official elinsky channels for updates or patches addressing this vulnerability.