CVE-2026-7599

A vulnerability was detected in Dayoooun hwpx-mcp 0.2.0. This affects the function save_document/export_to_text/export_to_html of the file mcp-server/src/index.ts of the component MCP Interface. Performing a manipulation of the argument output_path results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-22

• https://github.com/BruceJqs/public_exp/issues/28
• https://github.com/Dayoooun/hwpx-mcp/
• https://github.com/Dayoooun/hwpx-mcp/issues/3
• https://vuldb.com/submit/805608
• https://vuldb.com/vuln/360556
• https://vuldb.com/vuln/360556/cti

Published

May 1, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75982The LearnPress plugin for WordPress is vulnerable to unautho…4.4
• CVE-2026-75983The Eventin – Event Calendar, Tickets, Registration, Booking…7.5
• CVE-2026-75984A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b0…7.4
• CVE-2026-75985A flaw has been found in TRENDnet Router 1.1.02b01. The affe…7.4
• CVE-2026-75986A vulnerability has been found in code-projects Online Job P…7.3
• CVE-2026-75987A vulnerability was found in SPLWare esProc up to 20260507. …7.3
• CVE-2026-75990Illustrator is affected by an Incorrect Authorization vulner…8.6
• CVE-2026-75991Illustrator is affected by an Improper Input Validation vuln…8.6
• CVE-2026-75992Illustrator is affected by an out-of-bounds write vulnerabil…7.8
• CVE-2026-75993ColdFusion is affected by a reflected Cross-Site Scripting (…8.5
• CVE-2026-75998ColdFusion is affected by an Improper Access Control vulnera…7.5
• CVE-2026-75999ColdFusion is affected by an Improper Input Validation vulne…8.4