Executive brief
MCPVault is a Model Context Protocol server that provides safe access to Obsidian vaults. Its PathFilter security mechanism failed to block sensitive directories (.git, .obsidian, node_modules) when nested inside the vault rather than at the root level. This allows attackers to read configuration files containing credentials and remote URLs, as well as access sensitive application data through path manipulation in agent prompts.
Technical details
MCPVault's PathFilter uses anchored glob patterns that only block restricted directory names (.git, .obsidian, node_modules) at the vault root level. Nested instances of these directories—such as tools/cli/node_modules or tools/somerepo/.git/config—were fully accessible via isAllowed and isAllowedForListing methods, allowing traversal via path construction. This is a path traversal vulnerability (CWE-22) combined with sensitive information exposure (CWE-538). The attack vector is network-based with no authentication or user interaction required, exploitable under a prompt-injection threat model where an attacker influences which paths an agent reads. The vulnerability affects all versions before 0.11.5, which implements a fix to deny these restricted names at any path depth, matched case-insensitively.
Affected products
- Bitbonsai MCPVault < 0.11.5
Timeline
- 2026-06-19: disclosed
- 2026-06-19: patched: Fixed in version 0.11.5