CVE-2026-5327

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5327", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-01T13:27:15.115Z", "datePublished": "2026-04-02T11:45:11.124Z", "dateUpdated": "2026-04-02T13:23:04.196Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-02T11:45:11.124Z"}, "title": "efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "efforthye", "product": "fast-filesystem-mcp", "versions": [{"version": "3.5.0", "status": "affected"}, {"version": "3.5.1", "status": "affected"}], "cpes": ["cpe:2.3:a:efforthye:fast-filesystem-mcp:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in efforthye fast-filesystem-mcp up to 3.5.1. The affected element is the function handleGetDiskUsage of the file src/index.ts. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-04-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-01T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-01T15:32:26.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Yinci Chen (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/354658", "name": "VDB-354658 | efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354658/cti", "name": "VDB-354658 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780776", "name": "Submit #780776 | efforthye fast-filesystem-mcp <= 3.5.1 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/efforthye/fast-filesystem-mcp/issues/15", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/25822878/fast-filesystem-mcp_bug.pdf", "tags": ["exploit"]}, {"url": "https://github.com/efforthye/fast-filesystem-mcp/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T13:22:52.066928Z", "id": "CVE-2026-5327", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:23:04.196Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5327", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T13:22:52.066928Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:22:56.281Z"}}], "cna": {"title": "efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection", "credits": [{"lang": "en", "type": "reporter", "value": "Yinci Chen (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:efforthye:fast-filesystem-mcp:*:*:*:*:*:*:*:*"], "vendor": "efforthye", "product": "fast-filesystem-mcp", "versions": [{"status": "affected", "version": "3.5.0"}, {"status": "affected", "version": "3.5.1"}]}], "timeline": [{"lang": "en", "time": "2026-04-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-01T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-01T15:32:26.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354658", "name": "VDB-354658 | efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354658/cti", "name": "VDB-354658 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780776", "name": "Submit #780776 | efforthye fast-filesystem-mcp <= 3.5.1 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/efforthye/fast-filesystem-mcp/issues/15", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/25822878/fast-filesystem-mcp_bug.pdf", "tags": ["exploit"]}, {"url": "https://github.com/efforthye/fast-filesystem-mcp/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in efforthye fast-filesystem-mcp up to 3.5.1. The affected element is the function handleGetDiskUsage of the file src/index.ts. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-02T11:45:11.124Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5327", "state": "PUBLISHED", "dateUpdated": "2026-04-02T13:23:04.196Z", "dateReserved": "2026-04-01T13:27:15.115Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-02T11:45:11.124Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:efforthye:fast-filesystem-mcp:*:*:*:*:*:*:*:*"], "product": "fast-filesystem-mcp", "vendor": "efforthye", "versions": [{"status": "affected", "version": "3.5.0"}, {"status": "affected", "version": "3.5.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in efforthye fast-filesystem-mcp up to 3.5.1. The affected element is the function handleGetDiskUsage of the file src/index.ts. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha descubierto una falla de seguridad en efforthye fast-filesystem-mcp hasta la versi\u00f3n 3.5.1. El elemento afectado es la funci\u00f3n handleGetDiskUsage del archivo src/index.ts. Realizar una manipulaci\u00f3n resulta en inyecci\u00f3n de comandos. El ataque puede llevarse a cabo remotamente. El exploit ha sido liberado al p\u00fablico y puede ser utilizado para ataques. Se inform\u00f3 al proyecto del problema con antelaci\u00f3n a trav\u00e9s de un informe de problemas, pero a\u00fan no ha respondido."}], "id": "CVE-2026-5327", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5327", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T13:22:52.066928Z", "version": "2.0.3"}}]}, "published": "2026-04-02T12:16:21.260", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/efforthye/fast-filesystem-mcp/"}, {"source": "cna@vuldb.com", "url": "https://github.com/efforthye/fast-filesystem-mcp/issues/15"}, {"source": "cna@vuldb.com", "url": "https://github.com/user-attachments/files/25822878/fast-filesystem-mcp_bug.pdf"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/780776"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354658"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354658/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.5.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "fast-filesystem-mcp", "source": "cna", "vendor": "efforthye"}, "product": "fast-filesystem-mcp", "vendor": "efforthye"}], "analysis": {"en": {"generated_at": "2026-04-02T13:50:30.206345+00:00", "value": {"mitigation_remediation": ["Determine the current version of fast\u2011filesystem\u2011mcp you are running.", "If the version is 3.5.1 or older, upgrade to the latest release with the fix.", "If an upgrade is not possible immediately, restrict the service to localhost or limit inbound traffic to trusted hosts only.", "Monitor system logs for abnormal command execution or unexpected process activity."], "summary": {"action": "Immediate Patch", "impact": "Command Execution"}, "threat_synthesis": {"affected_systems": "Affected product: efforthye fast\u2011filesystem\u2011mcp, versions up to and including 3.5.1. Any installation using the handleGetDiskUsage endpoint in those releases is vulnerable. No impact on newer, unlisted versions is documented.", "description_and_impact": "The vulnerability resides in the handleGetDiskUsage function of fast\u2011filesystem\u2011mcp version 3.5.1 and earlier, allowing an attacker to inject arbitrary operating\u2011system commands through unsanitized input. This leads to remote command execution, compromising confidentiality, integrity, and availability. The weakness is a classic command injection identified by CWE\u201174 and CWE\u201177.", "risk_and_exploitability": "The CVSS score is 5.3, indicating moderate severity. No EPSS score is available and the vulnerability is not in KEV, so widespread exploitation is not yet recorded. However, an exploit has been publicly released and the attack can be carried out remotely, making the risk significant for exposed installations. The likely attack vector is remote network interaction via the service that invokes handleGetDiskUsage."}}}}, "created": "2026-04-02T20:12:46.297373+00:00", "updated": "2026-04-02T20:21:26.478635+00:00", "vendors": ["efforthye", "efforthye$PRODUCT$fast-filesystem-mcp"]}