Patch details for CVE-73 Path Traversal vulnerability in consciousness-explorer

Vulnerability Overview Vulnerability ID: CVE-73 Vulnerability Type: Path Traversal Report Date: 2026-04-17 Reporter: Bruce Jin (brucejin@zju.edu.cn) Vulnerability Description: CVE-73 (path traversal vulnerability reported by Bruce Jin) has been resolved. The same fix has been extended to the main MCP server ( + ). Impact Scope Affected Components: - and in - and in Severity: High (CWE-73 Arbitrary Write/Read) Status: - and were reported and fixed in #19. - and are newly discovered vulnerabilities, also subject to arbitrary write/read issues. Remediation Plan Fix Measures: - BaseName Only: Reject path separators ( or ), leading dots, NULL characters, ASCII control characters, overly long filenames (>255 bytes), and Windows reserved device names (CON, PRN, AUX, NUL, COM1-9, LPT1-9). - State/Vector Directory: and (each overridable via environment variables), created with permissions if they do not exist. - ResolvePath-relative Containment: Ensure does not start with and does not contain , mitigating platform-specific path normalization issues. - O_NOFOLLOW + O_CLOEXEC: Prevent symlink redirections of I/O operations planted in the final path component. - 0600 Mode: Set permissions for newly created files. - MCP Tool Mode: Validate constraints via JSON Schema, ensuring MCP clients see the constraints when "loading" them. Testing: - Local tests passed, including rejection of path separators, leading dots, control characters, overly long filenames, and Windows reserved device names. - restricts output to the configured directory and rejects traversal payloads. - / reject following symlinks in the final path component. - State files are created with permissions upon the first write. Code Block Additional Information Backward Compatibility: This is a breaking change; callers must pass a basename instead of an absolute path or a path containing separators. CVE Coordination: Recommend issuing a maintenance advisory, publishing a GitHub Security Advisory, and requesting a CVE ID.

Goal Reached Thanks to every supporter — we hit 100%!

Patch details for CVE-73 Path Traversal vulnerability in consciousness-explorer

More from this source