Threats affecting pkg:github/eiceblue/spire-doc-mcp-server

CVE-2026-7314 is a path traversal vulnerability in eiceblue spire-doc-mcp-server version 1.0.0. It affects the get_doc_path function in the src/spire_doc_mcp/api/base.py file, allowing remote attackers to manipulate the document_name argument to traverse directories. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The issue was reported to the project early, but no response or patch has been provided yet. Exploit code is publicly available, though no known exploitation in the wild has been confirmed.