EUVD-2026-71222
GHSA-q267-2jg6-m7vc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible MCP tool with no authentication gate; pure confidentiality-only impact with no integrity or availability effect on the vulnerable system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.
AnalysisAI
Arbitrary local file read in firecrawl-mcp-server 3.20.2 allows any caller of the firecrawl_parse MCP tool to extract sensitive host files - including credentials, SSH keys, and environment variables - by supplying absolute paths or directory traversal sequences as the unconstrained filePath argument. Retrieved file contents are uploaded and injected directly into the AI model's context window, making this both a direct exfiltration risk and a prompt-injection amplifier. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The firecrawl_parse tool must be active within the running MCP server instance - the tool is enabled by default in firecrawl-mcp-server and requires no special configuration to be present. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) reflects an unauthenticated, low-complexity network attack with high confidentiality impact, consistent with an MCP endpoint that imposes no authentication gate on tool invocations by default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade firecrawl-mcp-server to v3.24.1 or later, where the path containment fix is present in src/index.ts per the referenced tag (https://github.com/firecrawl/firecrawl-mcp-server/blob/v3.24.1/src/index.ts); note that a formal versioned patch announcement is not independently confirmed beyond this source reference, so operators should verify against the Firecrawl GitHub releases page (https://github.com/firecrawl/firecrawl-mcp-server) before assuming 3.24.1 is the definitive minimum safe version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all production deployments of firecrawl-mcp-server 3.20.2, restrict access to the firecrawl_parse MCP tool to trusted internal processes only, and review application logs for suspicious absolute-path or directory-traversal patterns in filePath arguments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file read and SSRF in Firecrawl before 2.11.32 lets an API caller exfiltrate files from the extraction worker
Firecrawl's Playwright scraping service through version 2.8.0 permits attackers to bypass SSRF protections and access in
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today