---
id: CVE-2026-27735
aliases:
  - GHSA-vjqx-cfc4-9h6v
  - PYSEC-2026-2630
title: >-
  mcp-server-git : Path traversal in git_add allows staging files outside
  repository boundaries
summary: >-
  mcp-server-git : Path traversal in git_add allows staging files outside
  repository boundaries
severity: medium
vendor: mcp-server-git
product: mcp-server-git
ecosystem: pip
affected:
  - mcp-server-git < 2026.1.14
patched:
  - mcp-server-git 2026.1.14
published: '2026-02-26'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vjqx-cfc4-9h6v'
references:
  - url: >-
      https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27735'
  - url: 'https://github.com/modelcontextprotocol/servers/pull/3164'
  - url: >-
      https://github.com/modelcontextprotocol/servers/commit/862e717ff714987bd5577318df09858e14883863
  - url: 'https://github.com/modelcontextprotocol/servers'
tags:
  - osv
  - pip
epss: 0.00287
epssPercentile: 0.21486
ingestedAt: '2026-07-13T18:58:03.634Z'
---

## Overview

In `mcp-server-git` versions prior to 2026.1.14, the `git_add` tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's `repo.index.add(`, which did not enforce working-tree boundary checks for relative paths. As a result, relative paths containing `../` sequences that resolved outside the repository were accepted and staged into the Git index, potentially allowing sensitive files to be exfiltrated via subsequent commit and push operations. The fix in PR #3164 switches to `repo.git.add()`, which delegates to the Git CLI and properly rejects out-of-tree paths. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue.

mcp-server-git thanks https://hackerone.com/0dd-g for reporting and contributing the fix.

## Affected packages

- `mcp-server-git < 2026.1.14`

## Remediation

Upgrade to a patched release:

- `mcp-server-git 2026.1.14`