EUVD-2026-83788
GHSA-6j48-ggfg-8xw2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to pdf-tools-mcp (PR:L)
-
ExploitSubmit crafted pdf_file_path pointing to internal target
-
ExecutionServer issues attacker-controlled request (SSRF)
-
ImpactRead/reach internal or metadata endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the pdf-tools-mcp MCP server component of cowork_bench be deployed and reachable, and that the attacker can invoke the ControlFlowNode tool with a controllable pdf_file_path argument. The CVSS PR:L indicates some privilege/authenticated access to the MCP tool interface is needed (not fully anonymous), while AC:L/UI:N mean no user interaction or special timing is required once access is obtained. Realistic exploitation is chiefly limited by the product's negligible deployment footprint (a single personal repository) rather than by technical preconditions; impact is bounded to server-initiated requests with Low confidentiality/integrity/availability effect. |
| Impact | This is a genuine but low-severity SSRF (CWE-918) in an obscure, personal GitHub project (0717376/cowork_bench), specifically its bundled pdf-tools-mcp MCP server. The vendor CVSS 4.0 base is 5.3 (MEDIUM) with AV:N/AC:L/PR:L and only Low technical impact across VC/VI/VA - a modest score that accurately reflects a low-privilege attacker triggering server-side requests with limited downstream effect. The SSVC/threat signal E:P (Proof-of-Concept) is corroborated by a publicly available exploit (GitHub Xh1Xxhg/public_exp issue #7), so 'publicly available exploit code exists' - but POC availability is NOT active exploitation. There is no EPSS score and no CISA KEV listing, consistent with a targeted-interest, near-zero real-world-exploitation profile for a niche tool. The dominant risk-limiting factor is prevalence, not exploit difficulty: this is a hobby/rolling-release repository with negligible production footprint. Net: low real priority despite a MEDIUM CVSS - the impact metrics are minor and the affected code is not widely deployed. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the pdf-tools-mcp interface supplies a crafted pdf_file_path value (e.g., pointing at an internal HTTP endpoint or cloud metadata service) to the ControlFlowNode function, causing the MCP server to issue an attacker-controlled request from its own network position. A public proof-of-concept exists demonstrating the manipulation, and because AV:N/AC:L the request can be initiated remotely with low complexity once the actor can reach and authenticate to the MCP tool. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Server-side request forgery in the pdf-tools-mcp MCP server bundled with the 0717376/cowork_bench project lets an attacker who can call its ControlFlowNode tool supply a crafted pdf_file_path argument and cause the server to issue requests to attacker-chosen destinations, yielding low confidentiality, integrity, and availability impact. The repository is a rolling-release personal project with no tagged versions, so all revisions up to commit d943e75bc0fc8e3b27141979300cd8cbcd1e890d are presumed affected, and the CVSS 4.0 vector (PR:L, E:P) indicates the tool interface requires some authenticated or privileged access rather than fully anonymous reach. Publicly available exploit code exists (published in a separate GitHub proof-of-concept repository), but there is no evidence of confirmed active exploitation, and the practical risk is heavily constrained by the product's negligible deployment footprint and the maintainer's failure to respond to the original issue report.
RemediationAI
No vendor-released patch identified at time of analysis: the maintainer has not responded to the reported issue and the repository ships only rolling-release code, so there is no fixed commit or tagged version to upgrade to. Until an upstream fix lands in the ControlFlowNode path handling of local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py, apply compensating controls: validate and strictly allow-list pdf_file_path against a fixed set of local directories and reject any scheme, host, or UNC-style prefix so the tool can never be induced to fetch remote resources; block outbound egress from the host running the MCP server (especially to link-local/cloud metadata addresses such as 169.254.169.254 and to internal RFC1918 ranges) - the trade-off is that legitimate remote PDF retrieval, if any is intended, stops working; bind the MCP server to loopback only and require authentication in front of the tool interface, which reduces exposure but does not remove the flaw for authorized callers; and run the server under a low-privilege identity with no access to sensitive internal services, noting that this limits blast radius without fixing the parameter handling itself. Track https://github.com/0717376/cowork_bench/issues/1 and the VulDB entry https://vuldb.com/vuln/407980 for an eventual upstream commit, and consider removing or disabling the pdf-tools-mcp component if it is not required in your deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is the ControlFlowNode function in local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py, part of a Model Context Protocol (MCP) server that exposes PDF tooling to an LLM or agent client. Because the pdf_file_path argument is used to build a server-side fetch without adequate validation or destination allow-listing, an attacker-controlled path (for example a URL or a path that triggers a remote retrieval) makes the server act as an HTTP client on the attacker's behalf - the classic CWE-918 server-side request forgery pattern. The CPE cpe:2.3:a:0717376:cowork_bench:*:*:*:*:*:*:*:* is wildcarded to reflect that this is a rolling-release repository with no versioned artifacts; the commit d943e75bc0fc8e3b27141979300cd8cbcd1e890d is the analyzed snapshot. SSRF in an MCP server is notable because the server typically runs with the tool-caller's network position and credentials, so the request can reach internal services, metadata endpoints, or the loopback interface that the caller cannot touch directly; the independent assessment nonetheless bounds the realistic effect to Low confidentiality/integrity/availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rather than a scope-changing or high-impact compromise.
Know when Cowork Bench gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote low-complexity SSRF needing low-privilege access to the MCP tool (PR:L); primary effect is limited internal-resource read, so C:L with I/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument pdf_file_path results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB