CVE-2026-15138

mediumCVSS 6.3covered by 1 sourcefirst seen 2026-07-09

A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validate_file_path of the file mcp_text_editor/text_editor.py. Such manipulation of the argument file_path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor closed the GitHub issue for this vulnerability without any explanation.

⚡ Watch CVE-2026-15138

Get an email if CVE-2026-15138 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-15138: A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue aff…nvd · 2026-07-09

External references

NVD record for CVE-2026-15138

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-15138 status](https://www.csirts.com/badge/CVE-2026-15138)](https://www.csirts.com/cve/CVE-2026-15138)