CVE-2026-15138

Name of the Vulnerable Software and Affected Versions tumf mcp-text-editor versions prior to 1.0.3

Description A path traversal issue exists in the validate file path() function within the mcp text editor/text editor.py file. This flaw allows a remote attacker to manipulate the file path argument to access files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations Update tumf mcp-text-editor to version 1.0.3 or later. As a temporary workaround, restrict access to the validate file path() function to minimize the risk of exploitation.