EUVD-2026-83753
GHSA-882h-38q7-cgpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed MCP analyze_csv_data tool
-
DeliverySupply traversal filename argument (../../)
-
ExploitBypass directory restriction in main.py
-
ExecutionRead arbitrary host file
-
ImpactExfiltrate sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a reachable instance of the 00Kisumi00 mcp-file-analyzer MCP server and the ability to invoke its analyze_csv_data tool with an attacker-controlled 'filename' argument (PR:L - an MCP client/agent connection is needed, so it is not fully anonymous). No user interaction and no non-default configuration are required beyond running the tool. Exploitation is limited by the product's near-zero deployment: it is a rolling-release hobby project with no published releases and an unresponsive maintainer, so there is no fixed version to pin and no vendor patch. |
| Impact | This is a genuine but low-severity path traversal (CWE-22) in an obscure open-source MCP tool. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring only low privilege (an actor able to invoke the MCP tool). The E:P (Proof-of-Concept) exploit maturity aligns with the confirmed public POC in the project's own GitHub issue tracker, so exploitation is 'publicly available exploit code exists' - but NOT KEV-listed and no active exploitation is claimed. No EPSS score is provided; given the tiny, single-author hobby-project footprint, real-world exploitation is likely to be negligible/opportunistic rather than widespread. The vendor scores confidentiality impact as VC:L; I dispute this - an unsanitized filename argument reaching a file-reading routine typically enables arbitrary file disclosure (VC:H), which would raise the score. Net: real vulnerability with a public POC, but the negligible deployment base and unresponsive maintainer make this a low operational priority for most defenders, not a high-CVSS-but-low-real-risk enterprise concern. |
| Exploit ScenarioDerived | An actor with the ability to send requests to (or drive an AI agent connected to) the mcp-file-analyzer server invokes the analyze_csv_data tool with a filename such as '../../../../etc/passwd'. The unsanitized path escapes the intended data directory, causing the tool to read and return the contents of an arbitrary file on the host. A public proof-of-concept exists in the project's GitHub issue #1. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Path traversal (CWE-22) in the 00Kisumi00 mcp-file-analyzer MCP tool allows authenticated remote attackers to read arbitrary files by supplying a crafted filename to the analyze_csv_data function implemented in main.py's ControlFlowNode. Publicly available exploit code exists, but the vulnerability is low severity (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and the project is a rolling-release hobby tool with near-zero deployment. No vendor patch has been released and the maintainer has not responded to the issue report.
RemediationAI
No vendor-released patch identified at time of analysis. Because the project is a rolling-release hobby tool with an unresponsive maintainer, users should apply compensating controls: restrict access to the MCP server to trusted clients only (reduces exposure but may limit legitimate agent functionality); implement input validation to reject filenames containing '../' or absolute paths before passing them to analyze_csv_data (may break legitimate file analysis if not carefully whitelisted); run the MCP server with least privilege in a sandboxed environment to limit the impact of arbitrary file reads; and disable the analyze_csv_data tool if it is not needed. Advisory references include https://github.com/00Kisumi00/mcp-file-analyzer/issues/1 and https://vuldb.com/vuln/407966.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mcp-file-analyzer is a rolling-release hobby project that exposes an MCP (Model Context Protocol) server; MCP is an open standard that lets AI assistants call external tools. The vulnerability lies in the analyze_csv_data tool, specifically in the ControlFlowNode function of main.py, where the filename argument is not sanitized before file access. This is a classic CWE-22 path traversal: an attacker can use sequences like '../' to read files outside the intended directory. The CPE cpe:2.3:a:00kisumi00:mcp-file-analyzer:*:*:*:*:*:*:*:* confirms the affected package and its wildcarded version, reflecting the project's rolling-release model with no fixed versions. The assessed impact is limited to confidentiality (C:H) with no integrity (I:N) or availability (A:N) impact, and exploitation requires an MCP client connection (PR:L).
Know when Mcp File Analyzer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable low-complexity traversal invocable by a low-privileged MCP client (PR:L); arbitrary file read is confidentiality-only, so I set C:H (disputing vendor VC:L) with I/A none.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyze_csv_data MCP tool. This manipulation of the argument filename causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB