CVE-2026-7314: eiceblue spire-doc-mcp-server Path Traversal Publicly Exploited

The National Vulnerability Database has disclosed CVE-2026-7314, a high-severity path traversal vulnerability impacting eiceblue spire-doc-mcp-server version 1.0.0. Specifically, the get_doc_path function within src/spire_doc_mcp/api/base.py is susceptible to manipulation via the document_name argument. This flaw allows for remote exploitation, and a public exploit is now available, significantly raising the immediate risk.

Attackers can leverage this vulnerability to traverse directories, potentially accessing or manipulating files outside of intended document paths. The National Vulnerability Database indicates that the project maintainers were notified early via an issue report but have not yet responded, leaving users exposed to active threats. The CVSS score is 7.3 (HIGH), reflecting the ease of exploitation (network-based, low attack complexity, no privileges or user interaction required) and potential impact on confidentiality, integrity, and availability.

This is a critical blind spot for defenders. With a public exploit in the wild and no vendor patch, organizations running affected versions are directly in the crosshairs. The attacker’s calculus is simple: low effort, high reward. They can quickly scan for vulnerable instances and immediately pivot to data exfiltration or system compromise. This isn’t theoretical; it’s a clear and present danger.