PowerPoint MCP Server EUVD-2025-211024

Exploitation requires that the Office-PowerPoint-MCP-Server (<= 2.0.7) is reachable by an AI agent and that the attacker can influence the agent's instructions via prompt injection, because the attack is carried out through the save_presentation, open_presentation, and manage_image (output_path) tool parameters, which accept absolute paths or ../ sequences without sanitization. Concrete limiting factors: the attacker does not authenticate to the tool (PR:N) but must (1) succeed at prompt injection to steer the agent (AT:P/AC:H), (2) rely on the agent actually invoking the file tool (UI:P), and (3) the impact is bounded by the OS privileges of the account running the MCP server - files must be server-writable to overwrite and server-readable to exfiltrate. Patched versions (post-PR #33) enforce path sanitization confining operations to the working directory unless absolute paths are explicitly allowed.

This is a genuine but conditional risk rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, VC:H/VI:H/VA:N) scores 7.6 (High) and is internally consistent with the description: no authentication is required at the tool boundary (PR:N), but exploitation is gated by high attack complexity (AC:H), a present attack requirement (AT:P), and passive user/agent interaction (UI:P) - reflecting that an attacker must first achieve prompt injection to steer the AI agent into calling the vulnerable tools. No EPSS score, KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of widespread automated exploitation. The signals are therefore aligned rather than conflicting: a high technical-impact flaw (arbitrary read/write of server-writable files) whose real-world exploitation depends on the attacker controlling the agent's instruction stream and the MCP server running with meaningful filesystem privileges. The absence of EPSS/KEV data means exploitation probability cannot be quantified; treat this as elevated priority specifically for anyone running the Office-PowerPoint-MCP-Server in an agent pipeline exposed to untrusted content, and routine priority otherwise.

An attacker plants prompt-injection content (e.g., in a document, email, or web page) that an AI agent later processes; the injected instructions direct the agent to call save_presentation or manage_image with an output_path like '../../../../home/user/.ssh/authorized_keys' or '../../etc/cron.d/x', writing attacker-controlled bytes outside the working directory. The same flaw lets open_presentation read arbitrary files such as /etc/passwd or config secrets back into the agent context. No public exploit was identified at time of analysis, though the vendor security audit documents working path-traversal test cases.