| タイトル | danielpopamd linkedin-ads-mcp 1.0.0 Arbitrary File Read |
|---|
| 説明 | The danielpopamd/linkedin-ads-mcp MCP server exposes a media upload tool that accepts a caller-controlled filePath argument. During the LinkedIn image upload flow, this value is passed to fs.readFileSync without enforcing that the resolved path remains inside an intended workspace or project directory.
In a local reproduction, the server was started in a disposable environment and the upload endpoint was mocked to avoid using real LinkedIn credentials. A test file was placed outside the repository directory, and the upload_image tool was invoked with filePath pointing to that out-of-scope file. The mocked upload endpoint received a request body containing the marker from the external file, confirming that the MCP server read the caller-supplied path and uploaded its contents.
This demonstrates that an MCP client or agent able to control tool arguments can cause the server process to read arbitrary local files accessible to its operating-system user, at least through the media upload path. Depending on deployment configuration and filesystem permissions, this may expose sensitive local files or credentials to an attacker-controlled upload destination or third-party service. |
|---|
| ソース | ⚠️ https://github.com/danielpopamd/linkedin-ads-mcp/issues/5 |
|---|
| ユーザー | cccccccti (UID 96695) |
|---|
| 送信 | 2026年07月12日 17:09 (2 月 ago) |
|---|
| モデレーション | 2026年08月26日 22:17 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 395979 [danielpopamd linkedin-ads-mcp 1.0.0 Media Upload campaign-management.ts fs.readFileSync filePath ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|