CVE-2026-27735 in servers
Summary
by MITRE • 02/26/2026
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/01/2026
The vulnerability identified as CVE-2026-27735 affects the Model Context Protocol Servers implementation within the mcp-server-git component, specifically exposing a directory traversal flaw in how file paths are validated during the git_add operation. This issue resides in the reference implementations for the Model Context Protocol, which serves as a framework for managing model contexts in machine learning workflows. The flaw stems from insufficient input validation mechanisms that fail to properly restrict file paths to repository boundaries, creating a potential security risk for systems relying on these implementations.
The technical root cause of this vulnerability lies in the implementation's use of GitPython's repo.index.add() method instead of the Git CLI for handling file staging operations. This design choice creates a path traversal condition where relative paths containing `../` sequences can navigate outside the intended repository boundaries. The git_add tool accepts these malformed paths without proper validation, allowing them to be processed and staged into the Git index. This behavior represents a classic directory traversal vulnerability where the system fails to sanitize user-provided paths before processing them, enabling attackers to manipulate the Git repository state beyond intended boundaries.
From an operational impact perspective, this vulnerability could enable malicious actors to manipulate Git repositories by adding files outside of the intended repository structure. The affected version range prior to 2026.1.14 allows for arbitrary path traversal through the git_add functionality, potentially leading to unauthorized file modifications, repository corruption, or information disclosure. The vulnerability specifically targets the staging process within Git operations, meaning that while the immediate impact may be limited to the staging area, it could potentially be leveraged to escalate privileges or create persistent backdoors within the repository structure.
Security practitioners should note that this vulnerability aligns with CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as directory traversal. The flaw also intersects with ATT&CK technique T1566.002, which involves spearphishing attachments, as attackers could potentially exploit this vulnerability through manipulated Git operations in compromised environments. The remediation approach requires upgrading to version 2026.1.14 or newer, which presumably implements proper path validation mechanisms to prevent relative path traversal outside repository boundaries. Organizations should also consider implementing additional controls such as file access monitoring, repository boundary checks, and regular security assessments of Git-based workflows to prevent similar issues in other components of their infrastructure.
The broader implications of this vulnerability extend beyond immediate repository manipulation, as it demonstrates how seemingly innocuous Git operations can become security risks when proper input validation is omitted. This issue highlights the importance of validating all user inputs, particularly in systems that interact with file systems or version control mechanisms. The vulnerability serves as a reminder that even reference implementations and standard tools can contain security flaws when proper boundary checks are not implemented, emphasizing the need for comprehensive security testing throughout the software development lifecycle. Organizations using Model Context Protocol Servers should conduct thorough vulnerability assessments of their Git-based workflows and implement proper path validation mechanisms to prevent similar directory traversal issues in other components of their systems.