Is CVE-2026-27735 actively exploited?

CVE-2026-27735 has no public evidence of in-the-wild exploitation as of 2026-04-14.

What is the CVSS score for CVE-2026-27735?

CVE-2026-27735 has a CVSS score of 6.4 (MEDIUM severity). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

How do I patch CVE-2026-27735?

Patch guidance is available from lfprojects security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-27735.

Which products are affected by CVE-2026-27735?

1 product: lfprojects model context protocol servers.

CVE-2026-27735 - remediation guidance & executive summary

Description

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue.

CVSS Metrics

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector: network
Complexity: low
Privileges: none
User Action: passive
Confidentiality: undefined
Integrity: undefined
Availability: undefined
Weaknesses: CWE-22 · Path Traversal

Metadata

Primary Vendor: LFPROJECTS
Published: 2/26/2026
Last Modified: 4/14/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

lfprojects : model_context_protocol_servers

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-27735. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-27735

View on NIST NVD

CVE-2026-27735 vulnerability