| शीर्षक | Deepractice PromptX 2.4.0 Improper Authorization |
|---|
| विवरण | An arbitrary local file read vulnerability (CWE-862) has been identified in @promptx/mcp-office of PromptX, specifically within packages/mcp-office/src/index.ts. Multiple MCP tools—including read_docx, read_xlsx, read_pptx, list_xlsx_sheets, and read_pdf—accept a user-supplied path argument and use it directly in filesystem operations such as fs.readFileSync and AdmZip without workspace-boundary enforcement or allowlisting. An attacker with access to the mcp-office server can read arbitrary Office or PDF files from any location on the local filesystem by providing an absolute path outside the intended workspace. Version 2.4.0 is confirmed affected, and no fixed version is available at the time of reporting.
|
|---|
| स्रोत | ⚠️ https://github.com/Deepractice/PromptX/issues/571 |
|---|
| उपयोगकर्ता | BruceJin (UID 96538) |
|---|
| सबमिशन | 10/04/2026 04:00 PM (6 महीनों पहले) |
|---|
| संयम | 27/04/2026 05:24 PM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359817 [Deepractice PromptX तक 2.4.0 Document File index.ts path सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|