Three MCP path-traversal CVEs published on the same day, all in file-reading tools

NVD·medium signalXBlueskyLinkedInCopy link

NVD published CVE-2026-94037 (00Kisumi00 mcp-file-analyzer, `analyze_csv_data` tool, `filename` argument), CVE-2026-94044 (03-lovepreetSingh MCP, `create_file` in app/api/mcp/route.ts, `filePath`/`content`) and CVE-2026-94046 (0215AndrewFeng ACE-MCP up to 4.10.8, `get_file_snippet` in getFileSnippet.ts, `projectRootPath`/`filePath`) on 2026-09-20, all path traversal, all remotely exploitable, all with public exploits. Three of the six MCP CVEs published that day are the same bug in the same place: a tool that takes a caller-supplied path and reads or writes it without confining it to a root. If you are writing an MCP server with any file verb, resolve the path and assert the prefix before touching the filesystem.