CVE-2026-86775: knowns Path Traversal via the Document API
The same unsafe filepath.Join that produced one CVE through the MCP tools produced a second one through the HTTP Document API — this time with write, delete, and directory creation attached.
taxonomy / tag