CVE-2026-81486: Path Traversal in bsmi021 mcp-file-context-server

The vulnerability in bsmi021 mcp-file-context-server 1.0.0 allows remote attackers to manipulate the path argument in the read_context function, causing path traversal. This enables unauthorized access to files outside the intended directory. The issue was reported early to the project, but no vendor response or patch has been provided. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. Exploit code is publicly available, increasing risk of exploitation.

Successful exploitation allows an attacker to read arbitrary files on the server by traversing directories, potentially exposing sensitive information. The vulnerability can be triggered remotely without authentication or user interaction. There is no indication of privilege escalation or integrity/availability impact.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing access controls or input validation to restrict path inputs and prevent traversal. Network-level protections such as web application firewalls may help mitigate exploitation attempts.