Ace Mcp
Monthly
Path traversal in 0215AndrewFeng ACE-MCP through 4.10.8 lets an authorized MCP tool client read arbitrary files from the host via the get_file_snippet tool: the attacker supplies both projectRootPath and filePath, and because projectRootPath is treated as trusted, setting projectRootPath=/etc with filePath=hosts satisfies the isPathInsideProjectRoot guard and exposes /etc/hosts. Exploitation requires the ability to invoke the MCP server's tool interface (authenticated, CVSS PR:L), needs no user interaction or special server configuration, and yields read-only confidentiality impact (no write or code execution). Publicly available exploit code exists and the issue was reported to the vendor, which has not responded or shipped a fix; the independent assessment rates confidentiality impact High, materially higher than the 2.1 CVSS 4.0 base score in the report, and no CISA KEV entry indicates confirmed active exploitation at time of analysis.
Path traversal in 0215AndrewFeng ACE-MCP through 4.10.8 lets an authorized MCP tool client read arbitrary files from the host via the get_file_snippet tool: the attacker supplies both projectRootPath and filePath, and because projectRootPath is treated as trusted, setting projectRootPath=/etc with filePath=hosts satisfies the isPathInsideProjectRoot guard and exposes /etc/hosts. Exploitation requires the ability to invoke the MCP server's tool interface (authenticated, CVSS PR:L), needs no user interaction or special server configuration, and yields read-only confidentiality impact (no write or code execution). Publicly available exploit code exists and the issue was reported to the vendor, which has not responded or shipped a fix; the independent assessment rates confidentiality impact High, materially higher than the 2.1 CVSS 4.0 base score in the report, and no CISA KEV entry indicates confirmed active exploitation at time of analysis.