CVE-2026-7627: MetaTrader 4 MCP Path Traversal Flaw

CVE-2026-7627 Overview

CVE-2026-7627 is a path traversal vulnerability [CWE-22] in the 8nite metatrader-4-mcp project version 1.0.0. The flaw resides in the CallToolRequestSchema function within src/index.ts, specifically in the sync_ea_from_file component. Attackers can manipulate the ea_name argument to traverse directories outside the intended path. The vulnerability is remotely exploitable and has been publicly disclosed. According to the CVE record, the project maintainer was notified through an issue report but has not yet responded.

Critical Impact
Authenticated remote attackers can read or write files outside the intended directory by supplying crafted ea_name values to the sync_ea_from_file tool handler.

Affected Products

8nite metatrader-4-mcp 1.0.0
Component: sync_ea_from_file
File: src/index.ts (function CallToolRequestSchema)

Discovery Timeline

2026-05-02 - CVE-2026-7627 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7627

Vulnerability Analysis

The metatrader-4-mcp project implements a Model Context Protocol (MCP) server that exposes tooling for MetaTrader 4 Expert Advisor (EA) workflows. The sync_ea_from_file tool accepts an ea_name parameter and uses it to construct a file path. The handler does not normalize or validate the supplied value, allowing directory traversal sequences such as ../ to escape the intended EA directory.

Because the handler is reachable through the MCP request path CallToolRequestSchema, any client able to invoke the tool can target arbitrary files within the host process's permissions. The vulnerability impacts confidentiality, integrity, and availability at a low level, consistent with file access scoped to the process user.

Root Cause

The root cause is missing input validation on the ea_name argument. The function concatenates the user-supplied name into a filesystem path without canonicalizing the result or enforcing a base-directory boundary. CWE-22 describes this class of weakness: improper limitation of a pathname to a restricted directory.

Attack Vector

An attacker with the ability to call the sync_ea_from_file tool sends a request containing an ea_name value such as ../../etc/passwd or a path pointing to sensitive configuration files. The server resolves the path relative to the EA directory but follows the traversal sequences to files outside it. Exploitation requires low privileges, no user interaction, and works over the network where the MCP server is exposed. Public disclosure references include the GitHub repository for metatrader-4-mcp, the open issue report, and the VulDB entry #360573.

No verified proof-of-concept code is available in trusted sources. Refer to the linked advisories for additional technical context.

Detection Methods for CVE-2026-7627

Indicators of Compromise

Requests to the MCP server invoking sync_ea_from_file with ea_name values containing ../, ..\, URL-encoded %2e%2e%2f, or absolute path prefixes.
File access events from the metatrader-4-mcp process touching paths outside the configured EA directory.
Unexpected reads or writes to files such as /etc/passwd, SSH keys, or MetaTrader configuration files by the MCP process.

Detection Strategies

Log all CallToolRequestSchema invocations and inspect the ea_name argument for traversal sequences and absolute paths.
Apply file integrity monitoring on directories adjacent to the EA folder to catch out-of-bounds writes.
Correlate MCP request logs with filesystem audit logs to identify path resolutions that escape the EA base directory.

Monitoring Recommendations

Forward MCP server logs and host filesystem telemetry to a centralized logging platform for correlation.
Alert on any process spawned by metatrader-4-mcp that opens files outside its working directory tree.
Track network connections to the MCP listener and validate that only authorized clients reach the sync_ea_from_file tool.

How to Mitigate CVE-2026-7627

Immediate Actions Required

Restrict network exposure of the metatrader-4-mcp server to trusted local clients only until a fix is published.
Run the MCP process under a least-privileged account that cannot read or write sensitive system files.
Audit existing EA directories and the MCP host for unauthorized file access or modification.

Patch Information

No official patch is available at the time of publication. The project maintainer has not responded to the disclosure issue tracked in the GitHub issue #1. Monitor the project repository for updates and review subsequent commits to src/index.ts for input validation changes.

Workarounds

Apply a local source patch that validates ea_name against an allowlist of permitted filenames and rejects values containing path separators or traversal sequences.
Canonicalize the resolved path with a function such as path.resolve and verify it remains within the configured EA base directory before performing file operations.
Containerize the MCP server with read-only mounts and a restricted filesystem scope to limit the blast radius of traversal attempts.

bash

# Configuration example: run metatrader-4-mcp in a restricted container
docker run --rm \
  --read-only \
  --tmpfs /tmp \
  -v /opt/mt4/ea:/app/ea:ro \
  --user 1500:1500 \
  --cap-drop=ALL \
  --network=host \
  metatrader-4-mcp:1.0.0