CVE-2026-77825— IBM ContextForge MCP Gateway is affected by path traversal
Quick assessment
Affected
IBM ContextForge MCP Gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM ContextForge MCP Gateway 1.0.0 至 1.0.8 版本在其 Admin API 的日志下载端点（ ）中存在路径遍历漏洞。该漏洞的路径隔离检查使用了 方法，而非正确的边界验证，导致已认证的管理员可以通过构造一个能解析为与日志目录具有相同字符串前缀的父级或同级目录的文件名，从而读取配置 之外的 、 和 文件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77825
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IBM ContextForge MCP Gateway is affected by path traversal
Source: CVE Program / CVE List V5
Vulnerability Description
IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path confinement check uses `str.startswith()` rather than proper boundary validation, allowing an authenticated admin to read `.log`, `.jsonl`, and `.json` files outside the configured `LOG_FOLDER` by supplying a filename that resolves into a sibling directory whose absolute path shares the log directory's string prefix.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | ContextForge MCP Gateway | 1.0.0 ~ 1.0.8 |
cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-77825
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77825
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-77825 (1)
Same Patch Batch · IBM · 2026-09-24 · 19 CVEs total
| CVE-2026-81549 | 9.6 CRITICAL | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-82093 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81552 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81548 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81547 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81545 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81539 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-77874 | 8.6 HIGH | IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities |
| CVE-2026-82094 | 7.1 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-6544 | 6.2 MEDIUM | Multiple Vulnerabilities in IBM Concert Software |
| CVE-2026-17504 | 5.1 MEDIUM | This Power System update is being released to address |
| CVE-2026-17503 | 5.1 MEDIUM | This Power System update is being released to address |
| CVE-2026-17413 | 5.1 MEDIUM | This Power System update is being released to address |
| CVE-2026-18870 | 4.3 MEDIUM | This Power System update is being released to address |
| CVE-2026-18857 | 3.4 LOW | This Power System update is being released to address |
| CVE-2026-17511 | 3.4 LOW | This Power System update is being released to address |
| CVE-2026-18104 | 3.3 LOW | IBM Db2 Mirror for i is vulnerable to obtain sensitive information [] |
| CVE-2026-19492 | 3.2 LOW | This Power System update is being released to address |
IV. Related Vulnerabilities
Same product: ContextForge MCP Gateway
-
CVE-2026-11918
IBM ContextForge MCP Gateway is affected by security filter -
CVE-2026-78573
IBM ContextForge MCP Gateway is affected by use of default c -
CVE-2026-18486
IBM ContextForge MCP Gateway is affected by credential discl -
CVE-2026-77822
IBM ContextForge MCP Gateway is affected by server-side requ
Same vendor: IBM
-
CVE-2026-93030
FortiManager 4.x XML外部实体注入漏洞 -
CVE-2026-93306
This Power System update is being released to address -
CVE-2026-84862
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84882
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84884
IBM Guardium Data Protection is affected by multiple vulnera
Same weakness: CWE-22
-
CVE-2026-90925
Path Traversal in Innotim Software's Logsign SIEM -
CVE-2026-85185
Path traversal in LXD btrfs storage driver allows arbitrary -
CVE-2026-85526
Path traversal via Btrfs optimized-backup subvolumes[].path -
CVE-2026-86334
CLI Path Traversal via Content-Disposition in LXD Image Expo -
CVE-2026-15953
Path Traversal During Project Archive Import
V. Comments for CVE-2026-77825
No comments yet