CVE-2026-7788
Axle-Bucamp MCP-Docusaurus document.py get_content path traversal
Vexday Risk Score
33Atención
Decisión SSVC (CISA)
Attend
PoC disponible → seguir de cerca
Madurez del exploit
Prueba de concepto
Existe prueba de concepto pública, pero aún no automatizada.
CVSS 6.9EPSS 0.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Ciclo de vida
05 may 2026Publicada en NVD
Recomendación: Planificar corrección próxima — ya existe PoC pública.
A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is the function update_document/continue_document/delete_document/get_content of the file app/routes/document.py. Performing a manipulation of the argument DOCS_DIR/path results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
Axle-Bucamp · MCP-DocusaurusPoCs públicas encontradas — 1
cve_referencegithub.com/Axle-Bucamp/MCP-Docusaurus/issues/2no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.