Linkedin Ads Mcp
Monthly
Path traversal in linkedin-ads-mcp 1.0.0 allows remote unauthenticated callers to read arbitrary files from the server's filesystem. The vulnerability exists in the Media Upload component where the `filePath` argument is passed directly to Node.js `fs.readFileSync` without sanitization, enabling directory traversal sequences to escape the intended media directory. A publicly available proof-of-concept exploit exists via a GitHub issue report; the maintainer has not responded to the disclosure.
Path traversal in linkedin-ads-mcp 1.0.0 allows remote unauthenticated callers to read arbitrary files from the server's filesystem. The vulnerability exists in the Media Upload component where the `filePath` argument is passed directly to Node.js `fs.readFileSync` without sanitization, enabling directory traversal sequences to escape the intended media directory. A publicly available proof-of-concept exploit exists via a GitHub issue report; the maintainer has not responded to the disclosure.