CVE-2026-15138: Path Traversal in tumf mcp-text-editor up to 1.0.2

Technical summary

The vulnerability resides in the _validate_file_path function within mcp_text_editor/text_editor.py. Insufficient path validation permits an attacker to inject path traversal sequences (such as ../ or absolute paths) into the file_path argument, bypassing intended directory restrictions. This falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The attack surface is remote and requires no authentication, though user interaction is necessary to complete the exploitation chain.

Business impact

Organizations relying on mcp-text-editor may experience unauthorized file disclosure, modification, or deletion depending on the application's operating context and file permissions. If the tool runs with elevated privileges or processes sensitive configuration files, confidentiality and integrity of critical data could be compromised. The public disclosure status elevates risk, as malicious actors now have documented attack pathways.

Affected systems

tumf mcp-text-editor versions up to and including 1.0.2 are confirmed vulnerable. Organizations should audit deployments to identify all instances of this software, particularly in development environments, CI/CD pipelines, or data processing workflows where it may have access to sensitive files.

Exploitability

Exploitability is moderate to high. The vulnerability requires remote network access and user interaction (satisfying CVSS requirements), but no authentication is necessary. The public disclosure means attack code or techniques are likely available to threat actors. The straightforward nature of path traversal attacks—combined with the lack of apparent vendor remediation—suggests exploitation is practical and may already be occurring in the wild.

Remediation

Immediate action: upgrade to a patched version beyond 1.0.2 if available from the vendor. Verify the vendor advisory or release notes for confirmation of remediation. If no patch is available, implement compensating controls such as restricting file system access permissions for the mcp-text-editor process, sandboxing the application, or disabling the feature if not critical to operations. Monitor the vendor's GitHub repository and security advisories for patch releases.

Patch guidance

Check the tumf project repository and official release channels for versions newer than 1.0.2 that address this vulnerability. Apply patches immediately upon availability. If operating a forked or internal version, apply the fix to the _validate_file_path function to enforce strict path validation (e.g., canonicalize paths and verify they remain within the intended base directory). Test patches in a non-production environment before deployment.

Detection guidance

Monitor file access logs and application behavior for unusual path traversal patterns (sequences like ../, absolute paths, or symbolic link usage) directed at mcp-text-editor. Review HTTP/API request logs for suspicious file_path parameters if the tool exposes this functionality over a network. Endpoint detection tools should flag attempts to access files outside expected directories from the mcp-text-editor process. Correlate such events with user interaction logs to identify potential exploitation attempts.

Why prioritize this

This vulnerability merits prioritization due to the combination of remote exploitability, public disclosure, and practical attack complexity. The CVSS 6.3 MEDIUM score reflects the required user interaction, but the real-world risk is elevated by the fact that exploitation techniques are documented and accessible. Organizations with mcp-text-editor in production—particularly in shared or multi-tenant environments—should treat this as a near-term remediation target.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects: remote network attack vector, low attack complexity, no privilege requirements, required user interaction, and impacts to confidentiality, integrity, and availability within a single security boundary. However, context matters: if mcp-text-editor processes sensitive configuration or credentials, or runs in a privileged context, real-world risk exceeds the base CVSS score. Public disclosure without vendor patching further elevates practical risk.

Frequently asked questions