EUVD-2026-65490
GHSA-x2cf-fchr-rw88
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exposed endpoint requires no auth or user interaction; partial read/write/availability impact is consistent with CWE-22 path traversal bounded by process-level OS permissions.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in dekdee's adobe-xd-mcp 1.0.0 exposes the server filesystem to remote unauthenticated attackers via unsanitized outputFile and outputDir parameters in the file-access-from-request endpoint of src/parsers/xd-parser.ts. A public proof-of-concept exploit is available through the project's GitHub issue tracker, and no patch has been released - the vendor has not responded to the disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The `file-access-from-request` endpoint in `src/parsers/xd-parser.ts` must be reachable over the network - the service must be listening on a non-loopback interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) represents a maximally reachable attack surface: network-accessible, low complexity, no authentication, no user interaction, and no specific attack preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends a crafted HTTP request to the `file-access-from-request` endpoint of an exposed adobe-xd-mcp instance, setting the `outputFile` parameter to a traversal payload such as `../../../../etc/passwd` or `../../../../home/user/.ssh/id_rsa`. The server processes this path without sanitization and returns the contents of the targeted file, leaking sensitive credentials or configuration. … |
| Remediation | No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the responsible disclosure report. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today