CVE-2026-7159

A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read_document/list_documents of the file server.py. Performing a manipulation of the argument docs_dir/file_path results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor confirms, that the "fix will be published within a few days."

• CWE-22

• https://github.com/douinc/mkdocs-mcp-plugin/
• https://github.com/douinc/mkdocs-mcp-plugin/issues/6
• https://github.com/douinc/mkdocs-mcp-plugin/issues/6#issuecomment-4223718119
• https://vuldb.com/submit/802063
• https://vuldb.com/vuln/359758
• https://vuldb.com/vuln/359758/cti

Published

Apr 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7156A vulnerability was detected in Totolink A8000RU 7.1cu.643_b…9.8
• CVE-2026-71560Out-of-bounds Read vulnerability in Apache Fory C++ deserial…9.1
• CVE-2026-7157A flaw has been found in disler aider-mcp-server up to b2516…7.3
• CVE-2026-71576A flaw was found in multicluster-global-hub. The manager com…8.5
• CVE-2026-71577A flaw was found in multicluster-global-hub. During a Manage…6.3
• CVE-2026-7158A vulnerability has been found in dmitryglhf mcp-url-downloa…7.3
• CVE-2026-7160A vulnerability was determined in Tenda HG3 2.0. This vulner…8.8
• CVE-2026-7161An insufficient encryption vulnerability exists in the Devic…9.3
• CVE-2026-7162Successful exploitation of the integer overflow vulnerabilit…7.8
• CVE-2026-7163A vulnerability in the assisted-service REST API, an optiona…5.5
• CVE-2026-7164Incorrect packet validation allowed unbounded recursion pars…7.5
• CVE-2026-7165The vulnerability is present in the ‘/addJugador’ endpoint: …9.4