CVE-2026-57441
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules pass both isAllowed() and isAllowedForListing() even though the operating system opens the restricted directory, and Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can use the bypass in read, write, move, search, or listing operations to expose or modify sensitive repository and Obsidian metadata. Vault-root .. containment is not affected. This issue is fixed in version 0.11.4.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.4
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.17%
- CWE
- CWE-41, CWE-178
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- bitbonsai mcpvault
Weakness type
Related vulnerabilities
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2025-24470 — An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.
- CVE-2022-0855 — Improper Resolution of Path Equivalence in microweber-dev/whmcs_plugin
- CVE-2024-8765 — Improper Path Equivalence Resolution in lunary-ai/lunary
- CVE-2026-5816 — Improper Resolution of Path Equivalence in GitLab
- CVE-2023-46169 — IBM DS8900F file manipulation
- CVE-2026-72835 — filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
- CVE-2026-34451 — Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories