CVE-2026-81491 Overview
CVE-2026-81491 is a path traversal vulnerability [CWE-22] affecting the boxpositron with-context-mcp project through version 3.0.7. The flaw resides in the ingest_notes, teleport_notes, sync_notes, and project_folder functions within src/index.ts. An attacker can manipulate file path input to access files outside the intended directory. The attack is remotely exploitable and requires no authentication or user interaction. A public exploit has been disclosed. The project maintainers were notified through an issue report but have not responded at the time of publication.
Critical Impact
Remote, unauthenticated attackers can traverse the filesystem through vulnerable note-handling functions, leading to disclosure or manipulation of files outside intended directories.
Affected Products
- boxpositron with-context-mcp versions up to and including 3.0.7
- Vulnerable file: src/index.ts
- Vulnerable functions: ingest_notes, teleport_notes, sync_notes, project_folder
Discovery Timeline
- 2026-08-27 - CVE-2026-81491 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-81491
Vulnerability Analysis
The vulnerability affects a Model Context Protocol (MCP) server implementation that handles note ingestion, transfer, synchronization, and project folder operations. The four impacted functions in src/index.ts accept file path arguments without sufficient normalization or containment checks. An attacker supplying crafted input containing directory traversal sequences such as ../ can escape the intended base directory and reach arbitrary files on the host filesystem.
Because the attack vector is network-based and requires no authentication, any client able to invoke the MCP server functions can attempt exploitation. The confidentiality, integrity, and availability impacts are each rated low, reflecting partial rather than complete filesystem compromise. A public exploit has been released, increasing the likelihood of opportunistic attacks against exposed instances.
Root Cause
The root cause is missing or inadequate input validation on file path parameters passed to the note-handling functions. The code does not enforce that resolved paths remain within a designated safe root directory, allowing traversal characters to redirect file operations outside the intended scope.
Attack Vector
An attacker submits a request to one of the vulnerable functions with a file path parameter containing traversal sequences. The server resolves the path relative to its working directory and performs read, write, or synchronization operations on the resulting location. This can expose sensitive configuration files, source code, or user data, and may allow writes to locations outside the intended scope.
Refer to the VulDB Vulnerability Report and the GitHub Issue Discussion for additional technical details.
Detection Methods for CVE-2026-81491
Indicators of Compromise
- Requests to the MCP server containing ../, ..\\, URL-encoded (%2e%2e%2f), or double-encoded traversal sequences in path parameters
- File access events from the with-context-mcp process targeting paths outside its configured working directory
- Unexpected reads of sensitive files such as /etc/passwd, SSH keys, or environment files by the Node.js process hosting the MCP server
Detection Strategies
- Inspect application logs for calls to ingest_notes, teleport_notes, sync_notes, or project_folder with abnormal path arguments
- Deploy filesystem auditing (auditd, Sysmon FileCreate/FileRead) on the host running the MCP server and alert on access outside the project directory
- Apply web application firewall or reverse-proxy rules that flag traversal patterns in incoming JSON payloads to the MCP endpoint
Monitoring Recommendations
- Track process ancestry and file operations of the Node.js runtime hosting with-context-mcp to detect anomalous file access
- Alert on outbound egress of files that should never leave the project directory, such as credentials or configuration data
- Retain MCP server request logs with full parameter payloads to enable retrospective hunting once patterns are known
How to Mitigate CVE-2026-81491
Immediate Actions Required
- Restrict network exposure of the with-context-mcp server to trusted clients only, using firewall rules or reverse-proxy authentication
- Run the MCP server under a low-privilege user account with filesystem access limited to the intended project directory
- Audit historical logs for exploitation attempts using traversal sequences against the vulnerable functions
Patch Information
No vendor patch is available at the time of publication. The project was notified through the GitHub Issue Discussion but has not responded. Monitor the upstream repository for a fixed release beyond version 3.0.7.
Workarounds
- Wrap or fork the affected functions to canonicalize input paths with path.resolve() and reject any resolved path that falls outside a fixed base directory
- Deploy the MCP server inside a container or chroot environment with read-only mounts for sensitive host paths
- Disable or remove the ingest_notes, teleport_notes, sync_notes, and project_folder functions if they are not required for your workflow
# Example: run MCP server as low-privilege user with restricted filesystem view
sudo useradd -r -s /usr/sbin/nologin mcpuser
sudo chown -R mcpuser:mcpuser /opt/with-context-mcp
sudo -u mcpuser node /opt/with-context-mcp/src/index.ts \
--project-root /opt/with-context-mcp/data
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
