CVE-2026-94046 0215AndrewFeng CVE debrief

Who should care

Defenders and administrators of systems using 0215AndrewFeng ACE-MCP up to 4.10.8 should assess exposure and prioritize verification and potential remediation. They should review and enhance path validation and sanitization in the get_file_snippet function, monitor for potential exploitation attempts, and track exceptions, retest remediated assets.

Why it matters

CVE-2026-94046 is a path traversal vulnerability in 0215AndrewFeng ACE-MCP up to 4.10.8 that can be exploited remotely. Defenders should prioritize verifying the affected versions, assessing exposure, and enhancing path validation and sanitization to prevent potential unauthorized file access or data leakage.

• Potential unauthorized file access
• Possible data leakage or system compromise
• Need for enhanced path validation and sanitization
• Verification of affected versions and exposure required

Technical summary

The get_file_snippet function in getFileSnippet.ts of 0215AndrewFeng ACE-MCP up to 4.10.8 is vulnerable to path traversal. The isPathInsideProjectRoot guard is insufficient as it only blocks filePath escaping the attacker-chosen projectRootPath, but not the root itself. This allows an attacker to potentially access unauthorized files or data, leading to data leakage or system compromise. Defenders should prioritize verifying the affected versions and assessing exposure in their environments, and enhance path validation and sanitization to prevent potential unauthorized file access.

Defensive priority

Defenders should prioritize verifying the affected versions and assessing exposure in their environments.

Recommended defensive actions

• Verify the version of ACE-MCP in use and assess exposure
• Review and enhance path validation and sanitization in the get_file_snippet function
• Monitor for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the extent of exploitation and affected versions require further verification. The get_file_snippet function in getFileSnippet.ts of 0215AndrewFeng ACE-MCP up to 4.10.8 is vulnerable to path traversal. The project was informed of the problem early through an issue report but has not responded yet.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.