Which versions of Office-Word-MCP-Server are affected by EUVD-2026-48308?

Office-Word-MCP-Server versions through 1.1.11 create a document confidentiality and integrity risk, enabling attackers to read and write any Word document the server can access through path…

Is there a public PoC exploit available for EUVD-2026-48308?

Yes, a public proof-of-concept exploit is available for EUVD-2026-48308. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-48308?

Within 24 hours, identify all production deployments of Office-Word-MCP-Server (gongrzhe) version 1.1.11 or earlier and document which are integrated with customer-facing systems or AI applications. Within 7 days, either disable the MCP server if operationally acceptable, or implement mandatory controls: restrict the server process filesystem access to only essential directories, validate all filename inputs to reject path traversal patterns (absolute paths and ../sequences), and establish comprehensive logging of document operations. Within 30 days, monitor security advisories and vendor notices for patch availability; if patches remain unavailable, evaluate alternative document processing tools and develop a migration plan.

Office-Word-MCP-Server EUVD-2026-48308

Q: What is the CVSS score of EUVD-2026-48308?

EUVD-2026-48308 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-65695 HIGH

Path Traversal (CWE-22)

2026-07-23 VulnCheck

GHSA-jp99-gp4p-v5cc

Path Traversal Microsoft Office Word Mcp Server

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

MCP interface is network-reachable (AV:N) but the malicious filename must be routed via a tool call requiring interaction and specific conditions (UI:R, AC:H); arbitrary .docx read and overwrite give C:H/I:H, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:15 vuln.today

CVE Published

Jul 23, 2026 - 16:20 cve.org

HIGH 7.6

DescriptionCVE.org

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the check_file_writeable and ensure_docx_extension helpers which perform no base-directory confinement or realpath validation.

AnalysisAI

Arbitrary .docx read and write in Office-Word-MCP-Server (gongrzhe) through version 1.1.11 lets an attacker who can influence the filename argument passed to the document tools escape the intended working directory using absolute paths or ../ sequences. Because the exposed open/save operations run in an MCP tool context, a malicious or prompt-injected instruction can read sensitive .docx files or create and overwrite documents anywhere the server process has filesystem access. Publicly available exploit code exists (VulnCheck), but there is no public exploit identified as actively used and it is not on CISA KEV.

Technical ContextAI

The affected component is Office-Word-MCP-Server, a Model Context Protocol (MCP) server that exposes Word/.docx manipulation tools to LLM clients. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the check_file_writeable and ensure_docx_extension helper functions validate writeability and file extension but perform no base-directory confinement and no realpath canonicalization. As a result, a supplied filename such as /etc/target.docx or ../../secrets/plan.docx is passed straight to the underlying python-docx open and save routines. The single CPE affected is cpe:2.3:a:gongrzhe:office-word-mcp-server:*:*:*:*:*:*:*:*, matching all versions up to and including 1.1.11.

RemediationAI

Upgrade to a fixed release above 1.1.11 once published by the maintainer; at the time of this analysis no exact fixed version number is confirmed in the provided data, so treat all versions through 1.1.11 as vulnerable and monitor the project repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/office-word-mcp-server-path-traversal-via-document-tools) for a patched tag. As compensating controls until a patched version is verified: run the MCP server under a dedicated low-privilege user with filesystem access restricted (via OS permissions, chroot, or a container bind-mount) to only the intended documents directory, which confines any traversal to that sandbox at the cost of blocking legitimate cross-directory access; add a wrapper that canonicalizes the filename with realpath and rejects any path resolving outside the configured base directory before calling open/save, accepting the trade-off of extra validation latency; and restrict which clients/prompts can invoke the document tools to limit prompt-injection reach. Do not rely on ensure_docx_extension or check_file_writeable as security boundaries - they do not confine the base directory.