{"id":"CVE-2026-57441","title":"MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault","summary":"MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without ca…","severity":"high","cvss":8.4,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-41","CWE-178"],"vendor":"bitbonsai","product":"mcpvault","affected":["mcpvault < 0.11.4"],"published":"2026-09-15","updated":"2026-09-15","sourceUpdated":"2026-09-15T20:17:24.337","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57441","references":[{"url":"https://github.com/bitbonsai/mcpvault/commit/0adb43901e1a08e85e14b42a8df2442fabc0b64a","label":"security-advisories@github.com"},{"url":"https://github.com/bitbonsai/mcpvault/commit/b9ea91a1c6d6adfec3e9e0483d9d79669e927fa8","label":"security-advisories@github.com"},{"url":"https://github.com/bitbonsai/mcpvault/security/advisories/GHSA-j99q-93c9-h869","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-15T18:57:31.418875Z"},"cvssSource":"cna","ingestedAt":"2026-09-15T18:41:59.142Z","epss":0.00174,"epssPercentile":0.0712,"slug":"CVE-2026-57441","body":"## Overview\n\nMCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules pass both isAllowed() and isAllowedForListing() even though the operating system opens the restricted directory, and Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can use the bypass in read, write, move, search, or listing operations to expose or modify sensitive repository and Obsidian metadata. Vault-root .. containment is not affected. This issue is fixed in version 0.11.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}