CVE-2026-77825

4.9 Moyenne

Publiée le 24/09/2026 à 17:17 · Modifiée le 29/09/2026 à 15:26 · Analysée par le NVD · Source : psirt@us.ibm.com

Description

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path confinement check uses `str.startswith()` rather than proper boundary validation, allowing an authenticated admin to read `.log`, `.jsonl`, and `.json` files outside the configured `LOG_FOLDER` by supplying a filename that resolves into a sibling directory whose absolute path shares the log directory's string prefix.

Traduire en français

Produits concernés

IBM ContextForge MCP Gateway
Ibm contextforge

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.9 Moyenne	psirt@us.ibm.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-22

Références

https://www.ibm.com/support/pages/node/7289314 PatchVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories