Is CVE-2026-7400 actively exploited?

No active exploitation of CVE-2026-7400 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-7400 be exploited remotely?

Yes. CVE-2026-7400 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-7400?

CVE-2026-7400 has a CVSS score of 7.3 (HIGH).

HOME VULNERABILITIESCVE-2026-7400

HIGH

CVE-2026-7400

CWE-22Published: April 29, 2026· Updated: Apr 29, 2026

7.3

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.8th

Official Description

A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0. This issue affects the function is_path_allowed of the file server.py of the component read_file_tool/write_file_tool. Such manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.1.0 is capable of addressing this issue. The name of the patch is 45364545fc60dc80aadcd4379f08042d3d3d292e. Upgrading the affected component is advised.

NVD Source

Technical Analysis

CVE-2026-7400 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.