VulnSocial

CVE-2026-94037Disclosure

LOWCVSS 2.1 · LOW

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyze_csv_data MCP tool. This manipulation of the argument filename causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-20); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-20: 1Mentions · 2026-10-19: 1PoC Mentioned / Linked · 2026-10-19: 1Patch / Workaround · 2026-10-19: 1Technical Details · 2026-09-20: 1Technical Details · 2026-10-19: 109-2010-19
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-201
Disclosure1
2026-10-191
PoC1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity@HugoValters
    PoC

    CVE-2026-94037 path traversal in 00Kisumi00 mcp-file-analyzer (CVSS 4.3), public exploit out, no patch. Update or block remote access now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94037/ #00Kisumi00 #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet announces CVE-2026-94037 as a path traversal vulnerability with a public exploit available, no vendor patch, and urges users to update or block remote access. The primary focus is on the public exploit disclosure.

    0000047
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-94037 A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file m… https://www.cve.org/CVERecord?id=CVE-2026-94037

    Post summary

    The text is an initial vulnerability disclosure for CVE-2026-94037 in mcp-file-analyzer, noting an affected commit range and affected function. It does not include PoC, exploit, active exploitation, or remediation details.

    000001.5K
    58.1K followersView on X

Explore more

Back to dashboard