Executive brief
mcpo-simple-server is a Python library used for managing prompts in LLM applications. An attacker can supply specially crafted file paths to the delete_shared_prompt function to access, modify, or delete files outside the intended directory, potentially exposing sensitive data, corrupting system files, or disrupting service availability.
Technical details
The vulnerability is a path traversal (CWE-22) in the delete_shared_prompt function within src/mcpo_simple_server/services/prompt_manager/base_manager.py. The function accepts an attacker-controlled detail parameter and uses it directly in filesystem operations (os.path.exists and os.remove) without canonicalization or boundary validation. An unauthenticated attacker can reach this function over the network via exposed API endpoints and supply traversal sequences (e.g., ../../../../tmp/codex_poc.txt) to escape the intended working directory. This allows arbitrary file read, write, and deletion with the privileges of the server process. No patch is currently available.
Affected products
- getsimpletool mcpo-simple-server up to 0.2.0
Timeline
- 2026-04-29: disclosed: CVE-2026-7404 published
- 2026-04-13: other: Vulnerability reported on GitHub issue #4