CVE-2026-81491

HIGH 7.3

boxpositron with-context-mcp index.ts project_folder path traversal

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_folder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-22
Vendor	boxpositron
Product	with-context-mcp
Published	Aug 27, 2026

Stay Ahead of the Next One

Get instant alerts for boxpositron with-context-mcp

Be the first to know when new high vulnerabilities affecting boxpositron with-context-mcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

boxpositron / with-context-mcp

3.0.0 3.0.1 3.0.2 3.0.3 3.0.4 3.0.5 3.0.6 3.0.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/395981 vuldb.com: https://vuldb.com/vuln/395981/cti vuldb.com: https://vuldb.com/cve/CVE-2026-81491 vuldb.com: https://vuldb.com/submit/887138 github.com: http://github.com/boxpositron/with-context-mcp/issues/2

Credits

🔍 cccccccti (VulDB User) VulDB CNA Team