CVE-2026-81491

Name of the Vulnerable Software and Affected Versions boxpositron with-context-mcp versions prior to 3.0.8

Description A flaw in the ingest notes/teleport notes/sync notes/project folder function within the src/index.ts file allows for remote path traversal. Path traversal is a condition where an attacker can access files and directories that are stored outside the web root folder by manipulating variables that control a file path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the ingest notes/teleport notes/sync notes/project folder function.