Threats affecting pkg:github/ravenwits/mcp-server-arangodb

CVE-2026-7715 is a medium severity path traversal vulnerability in the ravenwits mcp-server-arangodb product up to version 0.4.7. The flaw exists in the arango_backup function within src/tools.ts of the MCP Interface component, where manipulation of the outputDir argument allows an attacker to perform path traversal. This vulnerability can be exploited remotely without user interaction. The issue was publicly disclosed and reported to the project early, but no response or patch has been provided yet.