Executive brief
A security vulnerability exists in the tumf mcp-text-editor, a tool used for managing and editing text files. An attacker could exploit this flaw to access or modify files on the server that should be restricted. This could lead to the exposure of sensitive data or unauthorized changes to system files, potentially impacting business operations and data confidentiality.
Technical details
A path traversal vulnerability (CWE-22) exists in tumf mcp-text-editor versions up to 1.0.2. The flaw is located in the _validate_file_path function within mcp_text_editor/text_editor.py, where the application fails to properly confine directory access, reportedly using only a simple substring check for '..' that can be bypassed. A remote attacker can manipulate the file_path argument to perform arbitrary file read or write operations. While the exploit has been disclosed publicly, the vendor reportedly closed the associated GitHub issue without providing a formal patch or explanation.
Affected products
- tumf mcp-text-editor up to 1.0.2
Timeline
- 2026-06-05: disclosed: Vulnerability reported via GitHub issue #22
- 2026-07-09: advisory: NVD/VulDB publication date