EUVD-2026-33725
GHSA-vgmg-2m2p-qqqj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in ishayoyo excel-mcp up to 1.0.2. Impacted is an unknown function of the file src/index.ts of the component read_file/write_file. Executing a manipulation of the argument filePath/outputPath can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in ishayoyo excel-mcp (all versions through 1.0.2) allows remote low-privileged attackers to read or write arbitrary files on the host system by manipulating the filePath or outputPath arguments passed to the read_file and write_file MCP tool handlers in src/index.ts. The CVSS 4.0 score is 2.1 (Low), but a publicly available proof-of-concept exploit exists via a GitHub issue disclosure, and no vendor patch has been released - the maintainer has not responded to the responsible disclosure report. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis.
Technical ContextAI
excel-mcp is a Node.js-based Model Context Protocol (MCP) server that exposes read_file and write_file tool handlers for interacting with Excel files, implemented in src/index.ts. The CWE-22 (Path Traversal) root cause indicates that the filePath and outputPath arguments supplied by callers are passed to underlying filesystem operations without adequate sanitization or directory boundary enforcement - allowing sequences such as '../' to escape the intended working directory and reference arbitrary host filesystem paths. CPE cpe:2.3:a:ishayoyo:excel-mcp:*:*:*:*:*:*:*:* covers all versions through 1.0.2. MCP servers are increasingly integrated into AI agent pipelines, which may expose this component to a broader and less-trusted set of callers than traditional server software.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the responsible disclosure. Operators should immediately restrict access to the excel-mcp MCP server to fully trusted, authenticated users only; this does not eliminate the vulnerability but reduces the attacker pool consistent with the PR:L requirement. Where feasible, deploy the MCP server inside a containerized or sandboxed environment with strict filesystem namespacing - for example, Docker bind mounts scoped exclusively to an approved working directory - to contain path traversal impact to a restricted subtree. A targeted code-level workaround is to wrap filePath and outputPath inputs with Node.js path.resolve() followed by an allowlist prefix assertion (e.g., assert resolved path starts with ALLOWED_DIR) before any file I/O; this addresses the root cause but requires a code change not yet provided by the upstream maintainer. Monitor the GitHub repository (https://github.com/ishayoyo/excel-mcp/) and VulDB entry (https://vuldb.com/vuln/367571) for patch availability.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today