High 7.3Published Apr 29, 2026

CVE-2026-7398florensiawidjaja BioinfoMCP Upload Endpoint app.py upload path traversal

Updated under an hour ago (Oct 26, 2026, 6:00 AM ET)

Does this affect you?

It affects florensiawidjaja BioinfoMCP. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for florensiawidjaja BioinfoMCP

Exploited in the last 30 days

A weakness has been identified in florensiawidjaja BioinfoMCP up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54. This vulnerability affects the function Upload of the file bioinfo_mcp_platform/app.py of the component Upload Endpoint. This manipulation of the argument Name causes path traversal. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS: 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Apr 30, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

florensiawidjaja BioinfoMCP florensiawidjaja:bioinfomcp (from the name)	7ada7918b9e515604d3c0ae264d3a9af10bf6e54	CNA record

References

https://vuldb.com/vuln/360122vdb-entry, technical-description
https://vuldb.com/vuln/360122/ctisignature, permissions-required
https://vuldb.com/submit/803488third-party-advisory
https://github.com/florensiawidjaja/BioinfoMCP/issues/2exploit, issue-tracking
https://github.com/florensiawidjaja/BioinfoMCP/product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.