CVE-2026-7214
Published: 28 April 2026
Summary
CVE-2026-7214 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of inputs like WORKSPACE_PATH to block path traversal manipulations in file operations.
Mandates timely remediation of identified flaws such as this unpatched path traversal vulnerability through patching or mitigation.
Limits damage from successful path traversal by enforcing least privilege on the server process, restricting access to arbitrary files.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing server.py enables remote exploitation for initial access (T1190); read_file enables data collection from local system (T1005); list_files enables file/directory discovery (T1083); write_file enables ingress of tools/files (T1105).
NVD Description
A vulnerability was identified in eghuzefa engineer-your-data up to 0.1.3. This vulnerability affects the function read_file/write_file/list_files/file_inf of the file src/server.py. The manipulation of the argument WORKSPACE_PATH leads to path traversal. The attack may be initiated remotely. The exploit is publicly…
more
available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Deeper analysisAI
CVE-2026-7214 is a path traversal vulnerability (CWE-22) affecting the eghuzefa engineer-your-data project up to version 0.1.3. The issue resides in the read_file, write_file, list_files, and file_inf functions within src/server.py, where the WORKSPACE_PATH argument can be manipulated to traverse directories outside intended boundaries. Published on 2026-04-28, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), rated as high severity.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, such as reading, writing, listing, or obtaining information on arbitrary files accessible to the server process.
Advisories from VulDB and the project's GitHub repository indicate the issue was reported early via https://github.com/eghuzefa/engineer-your-data-mcp/issues/1, but the maintainers have not responded or released patches as of the latest information. The exploit is publicly available, increasing the risk of active use.
Notable context includes the public availability of the exploit, which may lead to real-world attacks, though no confirmed in-the-wild exploitation has been reported in the provided details.
Details
- CWE(s)