The vulnerability CVE-2026-7404 affects the getsimpletool mcpo-simple-server product, specifically versions 0.1 and 0.2.0. It arises from improper handling of input in the delete_shared_prompt function, enabling relative path traversal attacks. This allows an attacker to remotely manipulate file paths to access or delete files outside the intended directory scope. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity with network attack vector, no privileges required, and no user interaction needed. The vendor has been informed but has not issued a patch or official remediation.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to delete or access files outside the intended directory structure on the affected server. This could lead to unauthorized data modification or denial of service conditions. No evidence of exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as restricting network access to the affected service or using application-layer controls to validate and sanitize input paths to prevent traversal. Monitor vendor channels for updates and apply official patches once available.