Description

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_folder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-27T04:17:59.853Z",
  "pubdate": "2026-08-27T04:17:59.853Z",
  "executiveSummary": "A path traversal vulnerability exists in boxpositron with-context-mcp versions up to 3.0.7.\nThe flaw allows remote, unauthenticated attackers to escape intended directory constraints to access or manipulate arbitrary files on the underlying filesystem.\nThe vulnerability resides within core utility functions: ingest_notes, teleport_notes, sync_notes, and project_folder, all located in src/index.ts.\nSuccessful exploitation could result in unauthorized sensitive data exposure, modification, or deletion, depending on the permissions of the process executing the application.\nGiven that an exploit has been publicly disclosed and the maintainers have not yet addressed the report, the risk is elevated due to the potential for immediate exploitation by malicious actors.\nThis vulnerability is particularly dangerous in environments where the MCP server has access to sensitive project data or system configurations.",
  "technicalDetails": "The vulnerability is a classic path traversal flaw (CWE-22) stemming from improper sanitization of user-supplied input paths before performing file system operations.\nThe affected component is src/index.ts, specifically within the following functions: ingest_notes, teleport_notes, sync_notes, and project_folder. These functions appear to directly incorporate user-provided path components into file system APIs without verifying that the resulting path remains within the intended, restricted directory scope.\nThe attack flow involves an adversary crafting a malicious request containing directory traversal sequences, such as '../' or absolute paths, designed to bypass the application's intended file access boundaries. When the affected functions process this input, they resolve the path to locations outside the application's base directory.\nBecause these functions are designed to interact with notes or project files, an attacker can leverage this primitive to read arbitrary files from the server's filesystem, including sensitive configuration files, source code, or environment variables. If the application logic allows for write operations using these functions, an attacker might also achieve arbitrary file write, potentially leading to remote code execution (RCE) by overwriting executable scripts or configuration files.\nThis vulnerability is exploitable remotely and does not appear to require prior authentication, significantly increasing the attack surface. The exploitation requirement is minimal: the attacker simply needs the ability to send a crafted request to the endpoint that triggers any of the vulnerable functions in src/index.ts.\nSince the vulnerability lies within the fundamental file handling logic of the specified functions, the impact is comprehensive. Any file accessible to the user context running the with-context-mcp server is potentially at risk of unauthorized access or modification. The public availability of the exploit script facilitates automated or opportunistic exploitation attempts, making this a high-priority security issue."
}