Cyber Posture

CVE-2026-7214

High

Published: 28 April 2026

Published
28 April 2026
Modified
29 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 17.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-7214 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires validation of inputs like WORKSPACE_PATH to block path traversal manipulations in file operations.

prevent

Mandates timely remediation of identified flaws such as this unpatched path traversal vulnerability through patching or mitigation.

prevent

Limits damage from successful path traversal by enforcing least privilege on the server process, restricting access to arbitrary files.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
Why these techniques?

Path traversal in public-facing server.py enables remote exploitation for initial access (T1190); read_file enables data collection from local system (T1005); list_files enables file/directory discovery (T1083); write_file enables ingress of tools/files (T1105).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was identified in eghuzefa engineer-your-data up to 0.1.3. This vulnerability affects the function read_file/write_file/list_files/file_inf of the file src/server.py. The manipulation of the argument WORKSPACE_PATH leads to path traversal. The attack may be initiated remotely. The exploit is publicly…

more

available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Deeper analysisAI

CVE-2026-7214 is a path traversal vulnerability (CWE-22) affecting the eghuzefa engineer-your-data project up to version 0.1.3. The issue resides in the read_file, write_file, list_files, and file_inf functions within src/server.py, where the WORKSPACE_PATH argument can be manipulated to traverse directories outside intended boundaries. Published on 2026-04-28, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), rated as high severity.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, such as reading, writing, listing, or obtaining information on arbitrary files accessible to the server process.

Advisories from VulDB and the project's GitHub repository indicate the issue was reported early via https://github.com/eghuzefa/engineer-your-data-mcp/issues/1, but the maintainers have not responded or released patches as of the latest information. The exploit is publicly available, increasing the risk of active use.

Notable context includes the public availability of the exploit, which may lead to real-world attacks, though no confirmed in-the-wild exploitation has been reported in the provided details.

Details

CWE(s)

CVEs Like This One

CVE-2026-40876Shared CWE-22
CVE-2026-30914Shared CWE-22
CVE-2025-60946Shared CWE-22
CVE-2024-57549Shared CWE-22
CVE-2026-3795Shared CWE-22
CVE-2025-8729Shared CWE-22
CVE-2025-2264Shared CWE-22
CVE-2026-6615Shared CWE-22
CVE-2026-6024Shared CWE-22
CVE-2025-67160Shared CWE-22

References