CVE-2026-15138: mcp-text-editor Path Traversal Flaw

CVE-2026-15138 Overview

CVE-2026-15138 is a path traversal vulnerability affecting tumf mcp-text-editor versions up to 1.0.2. The flaw resides in the _validate_file_path function within mcp_text_editor/text_editor.py. Attackers can manipulate the file_path argument to escape the intended directory and access files outside the permitted scope. The issue is remotely exploitable and has been publicly disclosed. According to the CVE record, the vendor closed the associated GitHub issue without providing an explanation or a fix. This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Remote attackers can read or reference files outside the intended directory through crafted file_path arguments, with the vendor declining to address the report.

Affected Products

tumf mcp-text-editor versions up to and including 1.0.2
The vulnerable component is mcp_text_editor/text_editor.py
The vulnerable function is _validate_file_path

Discovery Timeline

2026-07-09 - CVE-2026-15138 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-15138

Vulnerability Analysis

The vulnerability exists in the _validate_file_path function inside mcp_text_editor/text_editor.py. This function is responsible for validating file paths supplied to the editor's Model Context Protocol (MCP) operations. The validation logic fails to properly restrict traversal sequences within the file_path argument. As a result, attackers can supply path components such as ../ to reference locations outside the intended working directory.

Because the tool operates as an MCP server, the file_path parameter is typically supplied by upstream callers, including AI agents or remote clients. This exposure makes the flaw reachable over the network without authentication. The EPSS score reported for this CVE is 0.347%.

Root Cause

The root cause is insufficient normalization and containment checks in _validate_file_path. The function does not resolve the canonical path and then verify that the resolved path remains within an allow-listed base directory. Without canonicalization followed by prefix validation, sequences like ../../etc/passwd bypass the intended restriction.

Attack Vector

An attacker with the ability to submit file_path values to the MCP text editor server can craft inputs that traverse the file system. Successful exploitation requires user interaction with the MCP client, but no privileges. The impact is limited to what the process running mcp-text-editor can access on the host, potentially exposing configuration files, source code, or secrets accessible to that user.

No verified exploit code is available in public repositories. The vulnerability mechanism is described in the VulDB CVE Analysis and the GitHub Issue Tracker.

Detection Methods for CVE-2026-15138

Indicators of Compromise

Requests to the mcp-text-editor service containing ../, ..\, encoded traversal sequences such as %2e%2e%2f, or absolute paths in the file_path parameter
File access events by the mcp-text-editor process outside its designated working directory
Unexpected reads of sensitive files such as /etc/passwd, SSH keys, or application configuration files by the Python process hosting the editor

Detection Strategies

Instrument the MCP server logs to record every file_path argument passed to _validate_file_path and alert on traversal patterns
Compare resolved canonical paths against the expected project root and flag any deviation
Correlate process-level file access telemetry with the invoking MCP request to identify out-of-scope reads

Monitoring Recommendations

Monitor endpoint file access telemetry for the Python interpreter process serving mcp-text-editor and alert on reads of system or user-secret files
Track outbound MCP traffic that references paths outside the configured workspace directory
Enable audit logging on the host to capture read operations on high-value files while the service is running

How to Mitigate CVE-2026-15138

Immediate Actions Required

Restrict network exposure of the mcp-text-editor service to trusted local clients only
Run the service under a dedicated low-privilege user account with access limited to the intended workspace
Apply operating system level sandboxing such as chroot, containers, or seccomp profiles to constrain file system reach
Review upstream MCP clients to ensure file_path values are sanitized before submission

Patch Information

At the time of publication, no vendor patch is available. The maintainer closed the GitHub issue without an explanation or remediation. Users should track the project repository for future updates and consider forking to apply a local fix that canonicalizes the path and validates containment within an allow-listed root.

Workarounds

Wrap the service in a container with a read-only file system and bind-mount only the directories that must be accessible
Add a proxy or wrapper that normalizes and validates file_path values before they reach _validate_file_path
Discontinue use of tumf mcp-text-editor in favor of an alternative MCP editor that enforces path containment until a patched release is available

bash

# Example: run mcp-text-editor in a restricted container with a bind-mounted workspace
docker run --rm \
  --read-only \
  --user 1000:1000 \
  --cap-drop=ALL \
  --network=none \
  -v /srv/mcp-workspace:/workspace:ro \
  mcp-text-editor:1.0.2