CVE-2026-81491: Path Traversal in boxpositron with-context-mcp

A path traversal vulnerability has been identified in boxpositron with-context-mcp up to version 3.0.7. The issue affects multiple functions (ingest_notes, teleport_notes, sync_notes, project_folder) in the src/index.ts file. This flaw allows an attacker to manipulate file paths remotely, potentially accessing unauthorized files. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Exploit code is publicly available, but the vendor has not yet provided a patch or official remediation.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to perform path traversal, potentially accessing or manipulating files outside the intended directories. This could lead to unauthorized information disclosure or modification of files. The impact is rated medium based on the CVSS score and vector, with limited confidentiality, integrity, and availability impact.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. In the meantime, consider implementing network-level controls to restrict access to the affected service and validate or sanitize inputs that interact with file paths to mitigate exploitation risk.