| عنوان | danielpopamd linkedin-ads-mcp 1.0.0 Arbitrary File Read |
|---|
| الوصف | The danielpopamd/linkedin-ads-mcp MCP server exposes a media upload tool that accepts a caller-controlled filePath argument. During the LinkedIn image upload flow, this value is passed to fs.readFileSync without enforcing that the resolved path remains inside an intended workspace or project directory.
In a local reproduction, the server was started in a disposable environment and the upload endpoint was mocked to avoid using real LinkedIn credentials. A test file was placed outside the repository directory, and the upload_image tool was invoked with filePath pointing to that out-of-scope file. The mocked upload endpoint received a request body containing the marker from the external file, confirming that the MCP server read the caller-supplied path and uploaded its contents.
This demonstrates that an MCP client or agent able to control tool arguments can cause the server process to read arbitrary local files accessible to its operating-system user, at least through the media upload path. Depending on deployment configuration and filesystem permissions, this may expose sensitive local files or credentials to an attacker-controlled upload destination or third-party service. |
|---|
| المصدر | ⚠️ https://github.com/danielpopamd/linkedin-ads-mcp/issues/5 |
|---|
| المستخدم | cccccccti (UID 96695) |
|---|
| ارسال | 12/07/2026 05:09 PM (2 أشهر منذ) |
|---|
| الاعتدال | 26/08/2026 10:17 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 395979 [danielpopamd linkedin-ads-mcp 1.0.0 Media Upload campaign-management.ts fs.readFileSync filePath اجتياز الدليل] |
|---|
| النقاط | 20 |
|---|