GitHub Advisoryadvisory · PyPI

GHSA-3jmq-qhg3-f58j mcpo-simple-server has a Path Traversal issue

MEDIUM Published 2026-04-29 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-7404
Ecosystem
PyPI
Packages
mcpo-simple-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-22
Reviewed
2026-05-06

Affected packages

• PyPI mcpo-simple-server: <= 0.2.0 (no fix yet)

Description

A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected is the function delete_shared_prompt of the file src/mcpo_simple_server/services/prompt_manager/base_manager.py. This manipulation of the argument detail causes relative path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Related

Alias · CVE (1)

  • CVE-2026-7404 A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References