CVE-2026-85661
excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 4, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 4, 2026
Description
excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
excel-mcp-serverharis-musa |
|
References
- GitHub Issue #149issue-tracking
- https://github.com/haris-musa/excel-mcp-serverproduct
- https://github.com/haris-musa/excel-mcp-server/blob/v0.1.8/src/excel_mcp/server.pytechnical-description
- https://github.com/haris-musa/excel-mcp-server/blob/v0.1.8/src/excel_mcp/validation.pytechnical-description
- VulnCheck Advisory: excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio modethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.