Medium severity · published Feb 25, 2026
CVE-2026-27735
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
servers · modelcontextprotocol
< 2026.1.14 · source: vendor
MC
Model Context Protocol Servers · Lfprojects
before 2026.1.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27735
Issue Tracking
https://github.com/modelcontextprotocol/servers/pull/3164
Patch
https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-vjqx-cfc4-9h6v
More from servers
9.1
CVE-2025-68145
mcp-server-git has missing path validation when using --repository flag
8.8
CVE-2025-68143
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
7.1
CVE-2025-68144
mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files