EUVD-2026-43273
GHSA-c7fc-wmwf-cvvh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector with low-privilege requirement for path traversal yielding limited read access; no integrity, availability, or scope-change impact applies.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicad_mcp/utils/path_validator.py. Performing a manipulation of the argument project_path/schematic_path results in protection mechanism failure. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path validation bypass in kicad-mcp up to 3.3.1 enables local low-privileged users to read files outside intended directory scope by manipulating the project_path or schematic_path arguments processed by kicad_mcp/utils/path_validator.py. The protection mechanism in this MCP (Model Context Protocol) server for KiCad PCB design software fails to adequately sanitize or normalize supplied paths, resulting in limited confidentiality impact with no integrity or availability consequences. No public patch is available as of this analysis; a proof-of-concept exploit exists publicly via GitHub issue #57, though the project maintainer has not yet responded to the disclosure.
Technical ContextAI
kicad-mcp is a Model Context Protocol (MCP) server integration layer for KiCad, an open-source EDA (Electronic Design Automation) tool used for PCB schematic and layout design. The vulnerability resides in kicad_mcp/utils/path_validator.py, which is responsible for validating file path arguments (project_path, schematic_path) before the application accesses files on the local filesystem. CWE-693 (Protection Mechanism Failure) identifies the root cause as a failure of the intended validation or sanitization logic - typically through path traversal sequences (e.g., ../), insufficient normalization, or symlink resolution bypass - that permits the caller to reference filesystem paths outside the intended project boundary. The CPE string cpe:2.3:a:lamaalrajih:kicad-mcp:*:*:*:*:*:*:*:* confirms all tracked versions through 3.3.1 are in scope. Because the flaw is in the validation utility rather than the MCP protocol layer itself, the impact is constrained to whatever the kicad-mcp process can access on the local system.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer was notified via the GitHub issue tracker but has not responded. Until a patch is released, the primary compensating control is restricting local system access to the kicad-mcp service to trusted users only; on shared systems, ensure untrusted local accounts cannot invoke kicad-mcp or control the project_path and schematic_path arguments it processes. Additionally, running the kicad-mcp process under a dedicated service account with filesystem permissions scoped strictly to the intended KiCad project directories (via OS-level discretionary access controls or filesystem namespacing) will limit the files reachable through a successful path traversal. Monitor https://github.com/lamaalrajih/kicad-mcp/ and https://github.com/lamaalrajih/kicad-mcp/issues/57 for patch availability. Note that restricting the process account's read permissions may interfere with legitimate kicad-mcp functionality if project files span multiple directories.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today