The handler had a containment check. It checked the folder, then joined an attacker-chosen filename onto it, then wrote somewhere else entirely. A copy of the same code in its parent project had been fixed two years earlier.
Docling validated every path it copied into the build directory, then handed the document to a Turing-complete typesetter that opens files on its own authority. The guard was real; it was just in the wrong layer.
The same unsafe filepath.Join that produced one CVE through the MCP tools produced a second one through the HTTP Document API — this time with write, delete, and directory creation attached.
Reading arbitrary files is bad. Writing them, with content you control, from an unauthenticated endpoint, is how a documentation import feature becomes a code execution chain.
An editing tool that accepts an absolute path and uses it verbatim is not a code editor with a bug. It is a file-write API that happens to be pointed at code most of the time.
A template preview endpoint that reads whatever path you hand it and returns the contents in JSON is an arbitrary file read with a friendly name — and in knowns before 0.30.0 it needed no credentials.
When an MCP tool argument reaches filepath.Join unvalidated, the attacker does not need to touch the server at all — they only need to get one sentence into something the model reads.