| Título | 00Kisumi00 mcp-file-analyzer 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 Path Traversal |
|---|
| Descripción | An arbitrary file read vulnerability (CWE-22) has been identified in the analyze_csv_data MCP tool of 00Kisumi00 mcp-file-analyzer, affecting all versions before commit 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. The tool accepts a user-supplied filename argument and joins it with DATA_DIR without verifying that the resolved path remains inside the intended data directory. By supplying an absolute path or path traversal sequence, an attacker with access to the MCP interface can read local text files accessible to the server process through pandas.read_csv, potentially exposing sensitive information. A working exploit has been demonstrated using /etc/passwd and is publicly available. |
|---|
| Fuente | ⚠️ https://github.com/00Kisumi00/mcp-file-analyzer/issues/1 |
|---|
| Usuario | Xh1Xxhg (UID 90906) |
|---|
| Sumisión | 2026-08-26 04:19 (hace 25 días) |
|---|
| Moderación | 2026-09-19 22:42 (25 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 407966 [00Kisumi00 mcp-file-analyzer hasta 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 analyze_csv_data MCP tool main.py ControlFlowNode filename recorrido de directorios] |
|---|
| Puntos | 20 |
|---|