| शीर्षक | puchunjie @puchunjie/doc-tools-mcp 1.0.18, Commit c96df45a16710a3eec41a7a94c32b81468db28ea Path Traversal |
|---|
| विवरण | An arbitrary file read and write vulnerability (CWE-73) has been identified in @puchunjie/doc-tools-mcp version 1.0.18, specifically within the create_document and open_document MCP tools. The tools accept a user‑supplied filePath argument and pass it directly to fs.writeFile or fs.readFile without constraining the path to a safe document directory, rejecting absolute paths, or validating traversal sequences. An attacker with network access to the MCP interface can write or read arbitrary Word documents (.docx files) at any filesystem location accessible to the server process, leading to data exposure, integrity loss, and potential service disruption. No fixed version is available at the time of reporting. |
|---|
| स्रोत | ⚠️ https://github.com/puchunjie/doc-tools-mcp/issues/4 |
|---|
| उपयोगकर्ता | BruceJqs (UID 97404) |
|---|
| सबमिशन | 18/04/2026 01:42 PM (6 महीनों पहले) |
|---|
| संयम | 03/05/2026 06:19 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 360913 [puchunjie doc-tools-mcp 1.0.18 MCP Interface src/mcp-server.ts create_document/open_document filePath निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|