CVE-2026-7159 | douinc mkdocs-mcp-plugin up to 0.4.1 server.py read_document/list_documents docs_dir/file_path path traversal

A vulnerability classified as critical has been found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read_document/list_documents of the file server.py. Performing a manipulation of the argument docs_dir/file_path results in path traversal.

This vulnerability is reported as CVE-2026-7159. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor confirms, that the “fix will be published within a few days.”