CVE-2026-85606 in Mcp Server
Summary
by MITRE • 09/04/2026
firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The firecrawl-mcp-server version 3.20.2 is affected by a critical arbitrary local file read vulnerability within its firecrawl_parse tool. This security flaw stems from an insufficient validation of user-supplied input, specifically regarding the filePath argument passed to the parsing function. The software fails to enforce directory containment checks or sanitize path components before processing them. Consequently, attackers can manipulate this parameter to bypass intended access controls and target files located outside the expected working directories on the host system where the server is executing.
From a technical perspective, the vulnerability allows for both absolute path specification and directory traversal sequences such as dot-dot-slash patterns. By supplying these maliciously crafted paths, an attacker can instruct the application to read arbitrary local files from the filesystem. This capability effectively neutralizes any sandboxing or isolation mechanisms that might otherwise restrict access to specific directories. The lack of input validation means there is no mechanism to ensure that the requested file resides within a permitted scope, leading directly to unauthorized data exposure.
The operational impact of this vulnerability is severe due to the subsequent handling of the read content. Once sensitive files are accessed, their contents are uploaded and returned to the model context in which the MCP server operates. This means that confidential information, such as environment variables containing API keys, database credentials, or other secrets stored in local configuration files, can be exfiltrated into the AI conversation flow. If this data is logged, cached, or processed by downstream systems connected to the model, it could lead to a broader compromise of the organization's infrastructure and sensitive intellectual property.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict file access to intended directories. Additionally, it relates to CWE-78: Improper Neutralization of Special Elements used in an OS Command if the path is interpreted by underlying system calls without sanitization. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1083: File and Directory Discovery, where adversaries probe for sensitive data on local systems.
To mitigate this risk, immediate patching to a version that addresses these input validation flaws is required. Developers should implement strict allow-lists for file paths or enforce canonicalization of all path inputs before processing. It is essential to validate that the resolved absolute path remains within an approved base directory using robust string manipulation and operating system-specific path resolution functions. Furthermore, principle of least privilege should be applied by running the service with minimal filesystem permissions so that even if traversal occurs, access to critical system files or credential stores is denied at the OS level rather than relying solely on application-level checks.