CVE-2026-57442 in MCPVault
Summary
by MITRE • 09/15/2026
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and node_modules path segments do not match the restriction and pass both isAllowed() and isAllowedForListing(). An attacker who influences a path selected by an AI agent can traverse nested repository or Obsidian metadata, read remote URLs or embedded tokens, or cause nested node_modules content to pollute the listAllTags index. This issue is fixed in version 0.11.5.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in MCPVault prior to version 0.11.5 represents a critical path traversal flaw rooted in the implementation of its PathFilter mechanism within src/pathfilter.ts. As a lightweight Model Context Protocol server designed to provide safe access to files within an Obsidian vault, MCPVault relies on strict filtering rules to prevent unauthorized data exposure or system manipulation. The core technical deficiency lies in the use of root-anchored deny-list patterns for path validation. This architectural choice creates a logical gap where nested directory segments containing sensitive markers such as .git, .obsidian, and node_modules are not correctly matched against the restriction list. Consequently, these paths bypass both the isAllowed() function used for general access checks and the isAllowedForListing() function responsible for enumerating available resources. This failure in path normalization or pattern matching allows an attacker to construct malicious file paths that appear valid under the flawed logic but actually point to restricted areas of the filesystem.
The operational impact of this vulnerability is significant, particularly given MCPVault's role as a bridge between AI agents and local data stores. An adversary who can influence the path selection process utilized by an integrated AI agent can exploit these bypassed filters to traverse into nested repository structures or Obsidian metadata directories. This capability enables the reading of sensitive information that was intended to be isolated, such as remote URLs embedded in configuration files or authentication tokens stored within .git history or vault settings. Furthermore, the vulnerability extends beyond simple data exfiltration; it allows for index pollution attacks against the listAllTags functionality. By accessing nested node_modules content, an attacker can inject malicious tags into the system's indexing mechanism, potentially leading to denial of service conditions through resource exhaustion or corrupting the integrity of search and retrieval operations within the Obsidian environment.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The specific mechanism involves failing to properly canonicalize paths before applying security filters, which is also related to CWE-73: External Control of File Name or Path. In the context of the MITRE ATT&CK framework, this flaw facilitates lateral movement and data staging by allowing unauthorized access to restricted directories (T1083) and potentially enables persistence through index manipulation if the system relies on these tags for automated workflows. The vulnerability highlights a common pitfall in security middleware where deny-lists are applied without ensuring that all path components are validated against the restrictions, rather than relying solely on root-level checks or incomplete pattern matching.
To mitigate this risk, it is imperative to upgrade MCPVault to version 0.11.5 or later, which addresses these filtering logic errors by implementing more robust path validation mechanisms. Security best practices for similar systems dictate that developers should avoid reliance on deny-lists alone and instead implement allow-listing strategies where only explicitly permitted paths are accessible. Additionally, any dynamic file access function must canonicalize the full resolved path before performing security checks to ensure that symbolic links or nested directory traversals do not bypass initial validation steps. For organizations currently running older versions of MCPVault, immediate patching is required to prevent potential data leakage and system integrity compromise through AI-driven agent interactions.