| 标题 | dekdee adobe-xd-mcp 1.0.0 Path Traversal |
|---|
| 描述 | The dekdee/adobe-xd-mcp MCP server exposes tools that accept caller-controlled filesystem paths, including path, outputFile, and outputDir arguments. These arguments are used for filesystem operations without enforcing a workspace boundary or validating that the resolved path remains inside an intended project directory.
In a local reproduction, the extract_colors tool was invoked with a valid XD input file inside the repository and an outputFile argument containing a directory traversal path such as ../outside-poc/pwned.css. The server returned success and created the file outside the repository directory. This demonstrates that an MCP client can cause the server to write files outside the intended workspace.
The issue may also affect read operations where caller-controlled XD file paths are passed to the parser and read through fs.readFile. However, the read impact should be treated as limited to parseable XD/ZIP files unless arbitrary file content disclosure is separately demonstrated.
Impact: In deployments where an MCP client, agent, or prompt-driven workflow can influence tool arguments, an attacker may cause the MCP server to write generated output to unintended filesystem locations outside the workspace. Depending on deployment permissions and target paths, this could overwrite files or place attacker-controlled generated content in sensitive locations. |
|---|
| 来源 | ⚠️ https://github.com/dekdee/adobe-xd-mcp/issues/3 |
|---|
| 用户 | cccccccti (UID 96695) |
|---|
| 提交 | 2026-07-12 15時53分 (1 月前) |
|---|
| 管理 | 2026-08-25 10時41分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 394961 [dekdee adobe-xd-mcp 1.0.0 file-access-from-request Endpoint src/parsers/xd-parser.ts outputFile/outputDir 目录遍历] |
|---|
| 积分 | 20 |
|---|