The vulnerability CVE-2026-9467 exists in debugmcp mcp-debugger versions up to 0.20.0, specifically in the handleGetSourceContext function within src/server.ts. It allows an attacker to perform a path traversal attack remotely, potentially accessing files outside the intended directory scope. The attack requires low privileges and no user interaction, with low complexity. The vendor was contacted but did not provide any response or patch. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows an attacker to traverse the file system paths remotely, potentially accessing sensitive files that should be restricted. This could lead to unauthorized information disclosure. The CVSS score of 5.3 reflects a medium severity impact with limited scope and no privilege escalation or integrity/availability impact indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch or workaround is available, users should consider restricting network access to the vulnerable service and monitor for exploitation attempts. Avoid exposing the mcp-debugger service to untrusted networks until a fix is released.