| タイトル | 00Kisumi00 mcp-file-analyzer 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 Path Traversal |
|---|
| 説明 | An arbitrary file read vulnerability (CWE-22) has been identified in the analyze_csv_data MCP tool of 00Kisumi00 mcp-file-analyzer, affecting all versions before commit 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. The tool accepts a user-supplied filename argument and joins it with DATA_DIR without verifying that the resolved path remains inside the intended data directory. By supplying an absolute path or path traversal sequence, an attacker with access to the MCP interface can read local text files accessible to the server process through pandas.read_csv, potentially exposing sensitive information. A working exploit has been demonstrated using /etc/passwd and is publicly available. |
|---|
| ソース | ⚠️ https://github.com/00Kisumi00/mcp-file-analyzer/issues/1 |
|---|
| ユーザー | Xh1Xxhg (UID 90906) |
|---|
| 送信 | 2026年08月26日 04:19 (25 日 ago) |
|---|
| モデレーション | 2026年09月19日 22:42 (25 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 407966 [00Kisumi00 mcp-file-analyzer 迄 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 analyze_csv_data MCP tool main.py ControlFlowNode filename ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|