---
id: CVE-2026-57441
title: >-
  MCPVault is a lightweight Model Context Protocol server for safe access to
  files in an Obsidian vault
summary: >-
  MCPVault is a lightweight Model Context Protocol server for safe access to
  files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts
  compiles restricted-directory patterns case-sensitively and compares paths
  without ca…
severity: high
cvss: 8.4
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-41
  - CWE-178
vendor: bitbonsai
product: mcpvault
affected:
  - mcpvault < 0.11.4
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T20:17:24.337'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57441'
references:
  - url: >-
      https://github.com/bitbonsai/mcpvault/commit/0adb43901e1a08e85e14b42a8df2442fabc0b64a
    label: security-advisories@github.com
  - url: >-
      https://github.com/bitbonsai/mcpvault/commit/b9ea91a1c6d6adfec3e9e0483d9d79669e927fa8
    label: security-advisories@github.com
  - url: >-
      https://github.com/bitbonsai/mcpvault/security/advisories/GHSA-j99q-93c9-h869
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T18:57:31.418875Z'
cvssSource: cna
ingestedAt: '2026-09-15T18:41:59.142Z'
epss: 0.00174
epssPercentile: 0.0713
---

## Overview

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules pass both isAllowed() and isAllowedForListing() even though the operating system opens the restricted directory, and Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can use the bypass in read, write, move, search, or listing operations to expose or modify sensitive repository and Obsidian metadata. Vault-root .. containment is not affected. This issue is fixed in version 0.11.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.