CVE-2026-7811: High-Severity Path Traversal in 54yyyu code-mcp
The National Vulnerability Database has disclosed CVE-2026-7811, a high-severity path traversal vulnerability (CVSS 7.3) affecting 54yyyu code-mcp, specifically in the is_safe_path function within src/code_mcp/server.py of the MCP File Handler component. This flaw allows for remote exploitation, enabling attackers to manipulate file paths and potentially access or modify arbitrary files on the system.
The vulnerability exists in code-mcp releases up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The project utilizes a rolling release model, meaning specific affected version numbers are not available. National Vulnerability Database indicates that the exploit details have been publicly disclosed, significantly increasing the risk of active exploitation. The vendor was notified but has not yet responded or provided a fix.
This is a critical oversight. Path traversal vulnerabilities, especially those remotely exploitable with public PoCs, are low-hanging fruit for attackers. Defenders need to assume this will be weaponized quickly. The lack of vendor response means organizations running this software are currently exposed, with no official patch path. This forces a defensive posture focused on detection and network segmentation.
What This Means For You
- If your organization uses 54yyyu code-mcp, immediately assess your exposure to CVE-2026-7811. Given the public exploit and lack of vendor patch, you need to isolate systems running this software, implement strict input validation at the network edge if possible, and monitor for any suspicious file access attempts or unauthorized directory traversals. Assume compromise until proven otherwise.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-7811: Path Traversal in 54yyyu code-mcp MCP File Handler
title: CVE-2026-7811: Path Traversal in 54yyyu code-mcp MCP File Handler
id: scw-2026-05-05-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-7811 by looking for path traversal sequences ('../') within the URI or query parameters. This vulnerability exists in the is_safe_path function of the MCP File Handler component in 54yyyu code-mcp, allowing remote attackers to access arbitrary files.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-7811/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '../'
cs-uri-query|contains:
- '../'
condition: cs-uri OR cs-uri-query
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-7811 | Path Traversal | 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8 |
| CVE-2026-7811 | Path Traversal | Vulnerable function: is_safe_path in src/code_mcp/server.py |
| CVE-2026-7811 | Path Traversal | Component: MCP File Handler |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 05, 2026 at 08:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7823: Critical Command Injection in Totolink A8000RU Routers
CVE-2026-7823 — A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the...
CVE-2026-7822 — Itsourcecode Courier Management System SQL Injection
CVE-2026-7822 — A vulnerability was identified in itsourcecode Courier Management System 1.0. This impacts an unknown function of the file /print_pdets.php. The manipulation of the...
CVE-2026-7812: Remote Command Injection in 54yyyu code-mcp MCP Tool
CVE-2026-7812 — A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The impacted element is the function git_operation of the file src/code_mcp/server.py of the...