CVE-2026-94037 in mcp-file-analyzer
Summary
by MITRE • 09/20/2026
A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyze_csv_data MCP tool. This manipulation of the argument filename causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified in the mcp-file-analyzer component within the 00Kisumi00 ecosystem represents a critical path traversal flaw located specifically within the ControlFlowNode function found in main.py. This security defect arises from insufficient validation of user-supplied input, particularly the filename argument passed to the analyze_csv_data MCP tool. By manipulating this parameter, an attacker can inject directory traversal sequences such as dot-dot-slash characters to escape the intended file system boundaries. The core technical failure lies in the application's inability to sanitize or canonicalize these paths before processing them, allowing external actors to read arbitrary files from the underlying operating system that reside outside of the designated working directories.
From a classification perspective, this vulnerability aligns directly with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This category encompasses flaws where software does not properly neutralize special elements within file paths or filenames, which can allow access to files and resources that are outside the restricted directory intended by the security policy. The presence of this flaw indicates a fundamental gap in input validation logic, where the application assumes all provided filename arguments will adhere strictly to expected structural constraints without performing rigorous checks against path normalization rules.
The operational impact of this vulnerability is severe due to its remote exploitability. Since the attack vector allows for remote exploitation, an adversary does not need local access or authentication privileges on the target system to initiate the attack. The availability of public exploits significantly lowers the barrier to entry for malicious actors, enabling widespread automated attacks against instances running vulnerable versions up to commit 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. Successful exploitation could lead to unauthorized disclosure of sensitive configuration files, source code, credentials stored in local text or JSON files, and potentially other critical system data depending on the permissions under which the application runs.
In terms of tactical mapping, this vulnerability facilitates actions consistent with ATT&CK technique T1083: File and Directory Discovery. Attackers leverage path traversal to enumerate and access restricted directories, serving as a precursor to more advanced stages such as Data Staged or Exfiltration over Alternative Protocol if the retrieved data is subsequently transmitted out of the network environment. The rolling release model employed by this project complicates mitigation efforts because version-specific patching information is not explicitly tracked in traditional ways. Consequently, administrators cannot rely on simple version number comparisons to determine vulnerability status and must instead monitor for specific code changes or commit hashes that address the input validation logic within main.py.
Mitigation strategies should focus primarily on implementing robust path canonicalization before any file system operations are executed. Developers must ensure that resolved paths remain strictly within the allowed base directory by comparing the absolute, normalized path against a whitelist of permitted directories. Additionally, employing allowlists for valid filename characters can prevent the injection of traversal sequences at an earlier stage in the request processing pipeline. Until a formal patch is released and adopted, users should restrict network exposure to this service, implement strict firewall rules limiting access to trusted IP ranges only, and consider deploying web application firewalls capable of detecting and blocking path traversal patterns in HTTP requests targeting the analyze_csv_data endpoint.