CVE-2026-15524: Memory-Bank-MCP Path Traversal Flaw

CVE-2026-15524 Overview

CVE-2026-15524 is a path traversal vulnerability [CWE-22] affecting alioshr/memory-bank-mcp versions up to 0.2.1/3.1. The flaw resides in the list-project-files-validation-factory.ts file, where the projectName argument is not properly sanitized before being used in file system operations. An attacker with local access and low privileges can manipulate this parameter to traverse directories and access files outside the intended project scope. The exploit has been disclosed publicly. According to VulDB, the project maintainer was notified through an issue report but has not yet responded.

Critical Impact
Local attackers with low privileges can read files outside the intended project directory by manipulating the projectName argument, resulting in limited confidentiality impact.

Affected Products

alioshr memory-bank-mcp up to version 0.2.1
alioshr memory-bank-mcp version 3.1
Component: list-project-files-validation-factory.ts

Discovery Timeline

2026-07-13 - CVE-2026-15524 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15524

Vulnerability Analysis

The vulnerability exists in the Model Context Protocol (MCP) server implementation memory-bank-mcp. The list-project-files-validation-factory.ts file processes user-supplied input via the projectName parameter. This parameter feeds into file listing logic without adequate validation for directory traversal sequences such as ../.

An attacker who submits a crafted projectName value containing traversal sequences can escape the intended project directory. The server then enumerates files in arbitrary locations accessible to the process. The impact is bounded to confidentiality of files within the local user's access scope, since exploitation requires local access with existing low-level privileges on the host.

The attack does not require user interaction. Because the MCP server is typically invoked by an LLM-driven client, exploitation could also occur through prompt-driven manipulation of tool arguments in an agentic workflow.

Root Cause

The root cause is missing or insufficient input sanitization on the projectName argument within list-project-files-validation-factory.ts. The validation factory fails to canonicalize the path or reject traversal metacharacters before joining projectName with the base directory used for file enumeration.

Attack Vector

Exploitation requires local access to the environment running the MCP server. An attacker supplies a projectName value containing ../ sequences to the vulnerable tool call. The server resolves the concatenated path outside the project root and returns a listing of files at the attacker-chosen location.

// Conceptual illustration of the flaw - no verified PoC code available
// Vulnerable pattern: projectName is joined without canonicalization
// listFiles(join(projectsRoot, projectName))
// A projectName like "../../etc" escapes projectsRoot.
// See referenced GitHub issue and VulDB entries for details.

Detection Methods for CVE-2026-15524

Indicators of Compromise

Tool call arguments to memory-bank-mcp where projectName contains .., ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths.
File listing responses from the MCP server that reference paths outside the configured projects root directory.
Repeated invocations of the list-project-files tool with varying projectName values consistent with enumeration behavior.

Detection Strategies

Inspect MCP server logs for projectName values that fail to match an allowlist of known project identifiers.
Instrument the Node.js process to log resolved absolute paths and flag any path that does not start with the configured projects base directory.
Correlate LLM client conversation logs with server-side tool invocations to identify prompt-injected traversal attempts.

Monitoring Recommendations

Monitor filesystem access by the MCP server process using host telemetry to identify reads outside the expected project tree.
Alert on execution of memory-bank-mcp binaries by unexpected users or from unexpected working directories.
Track upstream fixes on the alioshr memory-bank-mcp GitHub repository and the associated issue thread.

How to Mitigate CVE-2026-15524

Immediate Actions Required

Restrict local access to systems running memory-bank-mcp to trusted users only, since exploitation requires local privileges.
Run the MCP server under a dedicated low-privilege service account with filesystem access confined to the projects root directory.
Audit existing projectName inputs in logs for traversal patterns and investigate any anomalies.

Patch Information

At the time of publication, no vendor patch is available. Per the VulDB advisory, the maintainer of alioshr/memory-bank-mcp was notified via the GitHub issue tracker but has not yet responded. Users should track the repository for a fixed release.

Workarounds

Wrap or fork the affected code to validate projectName against a strict allowlist regex such as ^[A-Za-z0-9_-]+$ before use.
Canonicalize the resolved path with path.resolve() and verify it starts with the configured projects root before performing any file listing.
Deploy the MCP server inside a container or sandbox with a read-only filesystem outside the projects directory to contain traversal attempts.
Disable or remove the memory-bank-mcp integration from agentic clients until an upstream fix is released if the risk outweighs the functionality.

bash

# Example: run memory-bank-mcp under a restricted user with a bind-mounted projects directory
sudo useradd -r -s /usr/sbin/nologin mcpsvc
sudo -u mcpsvc node ./dist/index.js \
  --projects-root /srv/mcp/projects

# Optional: use a read-only container with only the projects path writable
docker run --rm \
  --read-only \
  --tmpfs /tmp \
  -v /srv/mcp/projects:/data/projects:ro \
  -u 10001:10001 \
  memory-bank-mcp:latest