| 标题 | 00Kisumi00 mcp-file-analyzer 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 Path Traversal |
|---|
| 描述 | An arbitrary file read vulnerability (CWE-22) has been identified in the analyze_csv_data MCP tool of 00Kisumi00 mcp-file-analyzer, affecting all versions before commit 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. The tool accepts a user-supplied filename argument and joins it with DATA_DIR without verifying that the resolved path remains inside the intended data directory. By supplying an absolute path or path traversal sequence, an attacker with access to the MCP interface can read local text files accessible to the server process through pandas.read_csv, potentially exposing sensitive information. A working exploit has been demonstrated using /etc/passwd and is publicly available. |
|---|
| 来源 | ⚠️ https://github.com/00Kisumi00/mcp-file-analyzer/issues/1 |
|---|
| 用户 | Xh1Xxhg (UID 90906) |
|---|
| 提交 | 2026-08-26 04時19分 (25 日前) |
|---|
| 管理 | 2026-09-19 22時42分 (25 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 407966 [00Kisumi00 mcp-file-analyzer 直到 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 analyze_csv_data MCP tool main.py ControlFlowNode filename 目录遍历] |
|---|
| 积分 | 20 |
|---|