CVE-2021-40978: Mkdocs

High severity, CVSS 7.5. EPSS: 15.1% chance of exploitation in the next 30 days.

The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1

Affected products

• Mkdocs Mkdocs: version 1.2.2 only

Published 2021-10-07. Last modified 2026-06-17.