| 제목 | 00Kisumi00 mcp-file-analyzer 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 Path Traversal |
|---|
| 설명 | An arbitrary file read vulnerability (CWE-22) has been identified in the analyze_csv_data MCP tool of 00Kisumi00 mcp-file-analyzer, affecting all versions before commit 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. The tool accepts a user-supplied filename argument and joins it with DATA_DIR without verifying that the resolved path remains inside the intended data directory. By supplying an absolute path or path traversal sequence, an attacker with access to the MCP interface can read local text files accessible to the server process through pandas.read_csv, potentially exposing sensitive information. A working exploit has been demonstrated using /etc/passwd and is publicly available. |
|---|
| 원천 | ⚠️ https://github.com/00Kisumi00/mcp-file-analyzer/issues/1 |
|---|
| 사용자 | Xh1Xxhg (UID 90906) |
|---|
| 제출 | 2026. 08. 26. AM 04:19 (26 날 ago) |
|---|
| 모더레이션 | 2026. 09. 19. PM 10:42 (25 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 407966 [00Kisumi00 mcp-file-analyzer 까지 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 analyze_csv_data MCP tool main.py ControlFlowNode filename 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|