Threats affecting pkg:github/getsimpletool/mcpo-simple-server

CVE-2026-7404 is a relative path traversal vulnerability in the getsimpletool mcpo-simple-server versions up to 0.2.0. The issue exists in the delete_shared_prompt function of the src/mcpo_simple_server/services/prompt_manager/base_manager.py file. This vulnerability allows remote attackers to manipulate input arguments to traverse directories and potentially access or delete unintended files. The vulnerability has been publicly disclosed and an exploit is available, but the vendor has not yet responded or provided a fix.