{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/mcpo-simple-server/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-7404"}],"_cs_exploited":false,"_cs_products":["mcpo-simple-server"],"_cs_severities":["high"],"_cs_tags":["path-traversal","web-application","cve-2026-7404"],"_cs_type":"advisory","_cs_vendors":["getsimpletool"],"content_html":"\u003cp\u003eA relative path traversal vulnerability, identified as CVE-2026-7404, has been discovered in getsimpletool mcpo-simple-server up to version 0.2.0. The vulnerability resides within the \u003ccode\u003edelete_shared_prompt\u003c/code\u003e function of the \u003ccode\u003esrc/mcpo_simple_server/services/prompt_manager/base_manager.py\u003c/code\u003e file. By manipulating the \u003ccode\u003edetail\u003c/code\u003e argument, a remote attacker can traverse the file system and delete arbitrary files. The vulnerability is remotely exploitable, and proof-of-concept exploit code is publicly available. The maintainers of the getsimpletool project have been notified of this vulnerability but have not yet responded. This poses a significant risk to systems running mcpo-simple-server, as it could lead to unauthorized file deletion and potential system compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a vulnerable mcpo-simple-server instance running version 0.2.0 or earlier.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request targeting the \u003ccode\u003edelete_shared_prompt\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe malicious request includes a manipulated \u003ccode\u003edetail\u003c/code\u003e argument containing relative path traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server-side application processes the request and passes the manipulated \u003ccode\u003edetail\u003c/code\u003e argument to the \u003ccode\u003edelete_shared_prompt\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edelete_shared_prompt\u003c/code\u003e function uses the attacker-controlled \u003ccode\u003edetail\u003c/code\u003e argument to construct a file path.\u003c/li\u003e\n\u003cli\u003eDue to the path traversal sequences, the resulting file path points to a location outside the intended directory.\u003c/li\u003e\n\u003cli\u003eThe application attempts to delete the file at the attacker-specified location.\u003c/li\u003e\n\u003cli\u003eIf permissions allow, the file is successfully deleted, leading to potential data loss or system instability.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to delete arbitrary files on the affected system. This can lead to data loss, application malfunction, or even complete system compromise, depending on the files targeted for deletion. Given the public availability of exploit code, systems running vulnerable versions of mcpo-simple-server are at immediate risk. The impact is especially severe if the targeted files are critical system files or application data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade mcpo-simple-server to a patched version that addresses CVE-2026-7404, if available from the vendor.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Mcpo-Simple-Server Path Traversal Attempt\u003c/code\u003e to identify exploitation attempts in web server logs.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization on the \u003ccode\u003edetail\u003c/code\u003e argument of the \u003ccode\u003edelete_shared_prompt\u003c/code\u003e function, if patching is not immediately feasible.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious activity, such as requests containing path traversal sequences.\u003c/li\u003e\n\u003cli\u003eRestrict file system permissions to limit the impact of successful path traversal attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-29T21:16:22Z","date_published":"2026-04-29T21:16:22Z","id":"/briefs/2026-04-mcpo-simple-server-traversal/","summary":"A relative path traversal vulnerability exists in getsimpletool mcpo-simple-server \u003c= 0.2.0, allowing remote attackers to delete arbitrary files via manipulation of the `detail` argument in the `delete_shared_prompt` function.","title":"Relative Path Traversal Vulnerability in mcpo-simple-server","url":"https://feed.craftedsignal.io/briefs/2026-04-mcpo-simple-server-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed — Mcpo-Simple-Server","version":"https://jsonfeed.org/version/1.1"}