Executive brief
MCPVault is a lightweight server for safe access to Obsidian vaults. The PathFilter component failed to properly normalize file paths before checking them against a deny-list of restricted directories (like .git, .obsidian, node_modules). An attacker could bypass these restrictions on Windows and macOS by using alternate case or adding trailing dots/spaces to directory names, gaining unauthorized read or write access to protected vault contents.
Technical details
MCPVault's PathFilter component performed case-sensitive matching and verbatim path comparison on case-insensitive filesystems (Windows, macOS), allowing attackers to bypass the deny-list via case variants (e.g., .Git, .GIT, .oBsIdIaN) or trailing dots/spaces (e.g., .git., .git ). The vulnerability affected both the isAllowed() method (read/write/move/search) and isAllowedForListing(). The root cause was failure to normalize file path segments and perform case-insensitive matching before deny-list validation. Vault-root containment checks were not affected. The vulnerability was fixed in version 0.11.4 by implementing case-insensitive matching and per-segment path canonicalization before the deny-list check.
Affected products
- Bitbonsai MCPVault < 0.11.4
Timeline
- 2026-06-18: disclosed
- 2026-06-18: patched: Fixed in version 0.11.4