CVE-2026-85661 in excel-mcp-server
Summary
by MITRE • 09/04/2026
excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in excel-mcp-server version 0.1.8 represents a critical failure in path confinement mechanisms within its standard input/output execution mode. This flaw stems from an improper validation of user-supplied file paths when the environment variable EXCEL_FILES_PATH is not explicitly defined or configured by the system administrator. In secure software design, especially for tools interacting with local filesystems via remote procedure calls like Model Context Protocol (MCP), strict path confinement is essential to prevent unauthorized access beyond designated directories. The absence of this safeguard creates a significant security gap that allows external actors to bypass intended isolation boundaries.
Technically, the issue arises because the application fails to sanitize or validate file paths provided through its read and write tools when operating in stdio mode without the protective environment variable. Instead of restricting operations to a specific sandboxed directory, the server processes arbitrary path strings directly passed by clients. This lack of input validation means that attackers can supply relative paths such as ../../etc/passwd or absolute paths pointing to sensitive system files. The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which highlights the failure to restrict file access to authorized locations. Additionally, this behavior aligns with ATT&CK technique T1083: File and Directory Discovery, as it enables attackers to enumerate and extract data from arbitrary locations on the host system where the server is running.
The operational impact of this vulnerability is severe due to its potential for full file read and write access. An attacker who can interact with the excel-mcp-server instance in stdio mode could exfiltrate sensitive configuration files, credentials stored in plaintext, source code repositories, or other proprietary data residing on the host machine. Furthermore, if the server process runs with elevated privileges, an attacker might overwrite critical system binaries or scripts to establish persistence or escalate privileges. This capability effectively compromises the confidentiality and integrity of the entire hosting environment, turning a utility tool into a vector for arbitrary file manipulation.
Mitigation strategies must focus on enforcing strict path confinement regardless of environmental configuration defaults. Developers should implement mandatory directory traversal checks that resolve all input paths to their canonical forms and verify they remain within an allowed base directory before performing any I/O operations. It is also recommended to make the EXCEL_FILES_PATH variable required rather than optional, ensuring that a secure context is always established at startup. For immediate remediation in production environments where patching may take time, administrators should ensure this environment variable is set to a restrictive path and consider running the service with minimal privileges using principles of least privilege to limit the potential damage if exploitation occurs.