| शीर्षक | 00Kisumi00 mcp-file-analyzer 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 Path Traversal |
|---|
| विवरण | An arbitrary file read vulnerability (CWE-22) has been identified in the analyze_csv_data MCP tool of 00Kisumi00 mcp-file-analyzer, affecting all versions before commit 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. The tool accepts a user-supplied filename argument and joins it with DATA_DIR without verifying that the resolved path remains inside the intended data directory. By supplying an absolute path or path traversal sequence, an attacker with access to the MCP interface can read local text files accessible to the server process through pandas.read_csv, potentially exposing sensitive information. A working exploit has been demonstrated using /etc/passwd and is publicly available. |
|---|
| स्रोत | ⚠️ https://github.com/00Kisumi00/mcp-file-analyzer/issues/1 |
|---|
| उपयोगकर्ता | Xh1Xxhg (UID 90906) |
|---|
| सबमिशन | 26/08/2026 04:19 AM (25 दिन पहले) |
|---|
| संयम | 19/09/2026 10:42 PM (25 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407966 [00Kisumi00 mcp-file-analyzer तक 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 analyze_csv_data MCP tool main.py ControlFlowNode filename निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|