CVE-2026-7319: elinsky execution-system-mcp add_action Tool server.py _get_context_file_path path traversal

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-28 · updated 2026-07-24
Weakness: CWE-22

Description

A flaw has been found in elinsky execution-system-mcp 0.1.0. The impacted element is the function _get_context_file_path of the file src/execution_system_mcp/server.py of the component add_action Tool. This manipulation of the argument context causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used.

Affected products

elinsky execution-system-mcp: 0.1.0

References

https://github.com/elinsky/execution-system-mcp/
https://github.com/elinsky/execution-system-mcp/issues/1
https://vuldb.com/submit/803085
https://vuldb.com/vuln/359972
https://vuldb.com/vuln/359972/cti

Get alerted when CVE-2026-7319 or the next vulnerability affects your stack