CVE-2026-27735

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27735", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-23T18:37:14.790Z", "datePublished": "2026-02-25T23:45:52.077Z", "dateUpdated": "2026-02-26T17:04:59.103Z"}, "containers": {"cna": {"title": "mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v"}, {"name": "https://github.com/modelcontextprotocol/servers/pull/3164", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/servers/pull/3164"}], "affected": [{"vendor": "modelcontextprotocol", "product": "servers", "versions": [{"version": "< 2026.1.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T23:45:52.077Z"}, "descriptions": [{"lang": "en", "value": "Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue."}], "source": {"advisory": "GHSA-vjqx-cfc4-9h6v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T17:04:33.296069Z", "id": "CVE-2026-27735", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:04:59.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27735", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T17:04:33.296069Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:04:49.724Z"}}], "cna": {"title": "mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries", "source": {"advisory": "GHSA-vjqx-cfc4-9h6v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "modelcontextprotocol", "product": "servers", "versions": [{"status": "affected", "version": "< 2026.1.14"}]}], "references": [{"url": "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v", "name": "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/modelcontextprotocol/servers/pull/3164", "name": "https://github.com/modelcontextprotocol/servers/pull/3164", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T23:45:52.077Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27735", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:04:59.103Z", "dateReserved": "2026-02-23T18:37:14.790Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T23:45:52.077Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "servers", "vendor": "modelcontextprotocol", "versions": [{"status": "affected", "version": "< 2026.1.14"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lfprojects:model_context_protocol_servers:*:*:*:*:*:*:*:*", "matchCriteriaId": "616D49C1-29CD-4DDA-B19A-9AA1001A2E2F", "versionEndExcluding": "2026.1.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue."}, {"lang": "es", "value": "Servidores de Protocolo de Contexto de Modelo es una colecci\u00f3n de implementaciones de referencia para el protocolo de contexto de modelo (MCP). En versiones de mcp-server-git anteriores a 2026.1.14, la herramienta git_add no validaba que las rutas de archivo proporcionadas en el argumento files estuvieran dentro de los l\u00edmites del repositorio. Debido a que la herramienta utilizaba repo.index.add() de GitPython en lugar de la CLI de Git, las rutas relativas que conten\u00edan secuencias '../' que se resolv\u00edan fuera del repositorio eran aceptadas y preparadas en el \u00edndice de Git. Se aconseja a los usuarios que actualicen a la versi\u00f3n 2026.1.14 o posterior para solucionar este problema."}], "id": "CVE-2026-27735", "lastModified": "2026-06-17T10:27:34.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27735", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T17:04:33.296069Z", "version": "2.0.3"}}]}, "published": "2026-02-26T00:16:25.017", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/modelcontextprotocol/servers/pull/3164"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.1.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "servers", "source": "cna", "vendor": "modelcontextprotocol"}, "product": "servers", "vendor": "modelcontextprotocol"}], "analysis": {"en": {"generated_at": "2026-04-17T14:40:41.631367+00:00", "value": {"mitigation_remediation": ["Upgrade Model Context Protocol Servers to version 2026.1.14 or later, which enforces path validation in git_add.", "Ensure that any scripts or services that invoke git_add are tightly controlled, allowing only trusted users or sanitized input.", "If possible, restrict or remove remote interfaces that expose git_add functionality to prevent untrusted path manipulation."], "summary": {"action": "Patch", "impact": "Staging Files Outside Repository Boundaries"}, "threat_synthesis": {"affected_systems": "Any installation of Model Context Protocol Servers using a version prior to 2026.1.14 is vulnerable. The issue resides in the mcp-server-git component and is part of the reference implementation set for the model context protocol (MCP).", "description_and_impact": "Model Context Protocol Servers\u2019 git_add tool fails to verify that paths specified in the files argument remain within the repository. This deficiency permits an attacker to craft relative paths containing sequences such as '../' that resolve to locations outside the intended repository. By doing so, the attacker can stage arbitrary files into the Git index, potentially overwriting or adding files critical to the server\u2019s operation or secrets. The weakness exemplifies a classic directory traversal flaw (CWE-22).", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.4, indicating moderate severity. The EPSS score is below 1%, suggesting a very low probability of exploitation as of this assessment. The CVE is not listed in CISA\u2019s KEV catalog. Exploitation requires the ability to invoke git_add with a crafted files argument; if git_add is exposed through remote APIs or automation scripts, an unauthenticated or authenticated attacker could potentially cause the server process to write files outside the repository, leading to integrity or confidentiality violations. The lack of path validation thus elevates the risk for deployments that allow untrusted input to the git_add tool."}}}}, "created": "2026-02-26T13:10:30.960383+00:00", "updated": "2026-04-17T14:45:21.036151+00:00", "vendors": ["modelcontextprotocol", "modelcontextprotocol$PRODUCT$servers"]}