CVE-2026-57441

HighCVSS 8.4

Published: 15/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

In MCPVault before 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules pass both isAllowed() and isAllowedForListing() even though the operating system opens the restricted directory, and Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can expose or modify sensitive repository and Obsidian metadata. Fixed in version 0.11.4.

Risk Assessment

An attacker who can influence a path selected by an AI agent can access restricted directories and expose or modify sensitive repository and Obsidian metadata. This may lead to information leakage or unauthorized file modifications.

Recommendation

Upgrade MCPVault to version 0.11.4, which properly canonicalizes paths and handles case variants and trailing dots/spaces. Until patched, consider restricting the AI agent's file operation permissions.

Other vulnerabilities in MCPVault

CVE-2026-57442Medium
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and node_modules path segments do not match the restriction and pass both isAllowed() and isAllowedForListing(). An attacker who influences a path selected by an AI agent can read remote URLs or embedded tokens or pollute the listAllTags index.

Original NVD description (English source)

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules pass both isAllowed() and isAllowedForListing() even though the operating system opens the restricted directory, and Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can use the bypass in read, write, move, search, or listing operations to expose or modify sensitive repository and Obsidian metadata. Vault-root .. containment is not affected. This issue is fixed in version 0.11.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS