CVE-2026-7728: mcp-rtfm Path Traversal Vulnerability

CVE-2026-7728 Overview

CVE-2026-7728 is a path traversal vulnerability [CWE-22] in ryanjoachim mcp-rtfm version 0.1.0. The flaw resides in the get_doc_content, read_doc, and update_doc functions of the MCP Interface component. Manipulation of the docFile argument allows an authenticated remote attacker to access or modify files outside the intended documentation directory. The exploit is publicly available through GitHub and VulDB references. The maintainer published patch commit e6f0686fc36012f78236e7fed172c81444904b0b to address the issue by introducing a validateDocFile function.

Critical Impact
Authenticated remote attackers can read or write files outside the intended documentation scope through unsanitized docFile parameters in the MCP Interface.

Affected Products

ryanjoachim mcp-rtfm 0.1.0
MCP Interface component (get_doc_content, read_doc, update_doc functions)
Downstream Model Context Protocol integrations consuming the affected handlers

Discovery Timeline

2026-05-04 - CVE-2026-7728 published to NVD
2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-7728

Vulnerability Analysis

The vulnerability exists in the MCP Interface document handlers within mcp-rtfm, a Model Context Protocol (MCP) server for documentation management. The get_doc_content, read_doc, and update_doc functions accept a docFile argument from MCP clients. The handlers do not validate that the supplied filename remains within the project documentation directory. Attackers can supply traversal sequences such as ../ to escape the intended directory and reach arbitrary files on the host. The flaw is reachable over the network and requires only low privileges, with no user interaction.

Root Cause

The handler code in src/handlers/doc-handlers.ts and src/handlers/refresh-handlers.ts imported only validateProjectPath and relied on getDocsPath for path construction. No dedicated validation existed for the docFile parameter. Consequently, user-controlled input was concatenated into filesystem paths without canonicalization or boundary enforcement, satisfying the conditions of [CWE-22].

Attack Vector

A remote attacker with access to the MCP server invokes one of the affected tools and supplies a crafted docFile value containing path traversal sequences. The server resolves the path outside the documentation directory and returns or overwrites the targeted file. Because update_doc permits write operations, the impact extends from information disclosure to integrity loss on any file the server process can modify.

typescript

// Patch excerpt: src/handlers/doc-handlers.ts
 import { contextManager } from "../project-context.js";
 import { analyzeContent, categorizeContent, updateMetadata, updateSearchIndex } from "../content.js";
-import { validateProjectPath } from "../validation.js";
-import { handleToolError, freshTimestamp, getDocsPath } from "../utils.js";
+import { validateProjectPath, validateDocFile } from "../validation.js";
+import { handleToolError, freshTimestamp } from "../utils.js";
 import { logger } from "../logger.js";
 import { ReadDocSchema, UpdateDocSchema } from "../schemas.js";

Source: GitHub Commit e6f0686

Detection Methods for CVE-2026-7728

Indicators of Compromise

MCP request payloads containing ../, ..\\, URL-encoded %2e%2e%2f, or absolute paths in the docFile argument.
Access by the mcp-rtfm process to files outside the configured docs directory, such as /etc/passwd, .env, or SSH key paths.
Unexpected modifications to system configuration files where the MCP server has write access.

Detection Strategies

Inspect MCP server request logs for read_doc, update_doc, and get_doc_content calls with traversal sequences in docFile.
Monitor process-level file access for the mcp-rtfm runtime to detect reads or writes outside the documentation root.
Compare deployed mcp-rtfm versions against patch commit e6f0686fc36012f78236e7fed172c81444904b0b to identify unpatched instances.

Monitoring Recommendations

Enable verbose logging on MCP handlers and forward events to a centralized SIEM for correlation.
Alert on filesystem syscalls from the MCP service that resolve outside the project root after symlink resolution.
Track outbound responses from the MCP server for sensitive file content patterns indicating successful traversal.

How to Mitigate CVE-2026-7728

Immediate Actions Required

Apply the upstream patch e6f0686fc36012f78236e7fed172c81444904b0b from the mcp-rtfm repository to introduce validateDocFile checks.
Restrict network exposure of the MCP server to trusted clients only until patching is verified.
Audit existing documentation directories and host filesystems for unauthorized reads or modifications.

Patch Information

The maintainer fixed the issue by adding a validateDocFile function to src/validation.ts and importing it into src/handlers/doc-handlers.ts and src/handlers/refresh-handlers.ts. The patch removes reliance on getDocsPath alone and enforces that docFile resolves within the permitted documentation root. Refer to GitHub Issue #5 and the GitHub Commit e6f0686 for the full diff.

Workarounds

Run the MCP server under a dedicated low-privilege user with filesystem access limited to the documentation directory.
Deploy a mandatory access control profile (AppArmor, SELinux) that confines the mcp-rtfm process to the docs path.
Place a request filter in front of the MCP endpoint that rejects docFile values containing .., absolute paths, or encoded traversal sequences.

bash

# Example AppArmor-style confinement for the mcp-rtfm process
/usr/local/bin/mcp-rtfm {
  /opt/mcp-rtfm/docs/** rw,
  deny /etc/** r,
  deny /home/** r,
  deny /root/** rw,
}