Mcp File Analyzer
Monthly
Path traversal (CWE-22) in the 00Kisumi00 mcp-file-analyzer MCP tool allows authenticated remote attackers to read arbitrary files by supplying a crafted filename to the analyze_csv_data function implemented in main.py's ControlFlowNode. Publicly available exploit code exists, but the vulnerability is low severity (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and the project is a rolling-release hobby tool with near-zero deployment. No vendor patch has been released and the maintainer has not responded to the issue report.
Path traversal (CWE-22) in the 00Kisumi00 mcp-file-analyzer MCP tool allows authenticated remote attackers to read arbitrary files by supplying a crafted filename to the analyze_csv_data function implemented in main.py's ControlFlowNode. Publicly available exploit code exists, but the vulnerability is low severity (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and the project is a rolling-release hobby tool with near-zero deployment. No vendor patch has been released and the maintainer has not responded to the issue report.