Description

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T05:16:50.810Z",
  "pubdate": "2026-08-09T05:16:50.810Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the bazylhorsey obsidian-mcp-server version 1.0.0. The security flaw resides within the readCanvas and writeCanvas functions implemented in the source file src/services/CanvasService.ts.\nThis vulnerability allows an attacker to perform arbitrary file read and write operations outside the intended boundaries of the vault directory by manipulating file path parameters. The risk implications include unauthorized access to sensitive local system files, potential data tampering, and compromise of system integrity.\nExploitation of this vulnerability requires local access to the target environment where the Model Context Protocol server is operating. The project maintainers were notified of the issue through an initial issue report but have not provided a response or official patch.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and lack of robust path canonicalization within the canvas file handling logic. Specifically, the readCanvas and writeCanvas functions located in src/services/CanvasService.ts process file path arguments supplied via the Model Context Protocol without adequately validating or restricting them to the designated root directory.\nBecause path traversal sequences such as dot-dot-slash (../) are not properly filtered or neutralized, an attacker with local execution capabilities or the ability to interact with the local MCP server instance can supply maliciously crafted paths. These payloads force the application to traverse upwards in the directory tree.\nThe attack flow proceeds as follows: First, the adversary identifies the local interface or mechanism through which requests are routed to the obsidian-mcp-server. Second, the attacker formulates an input payload containing directory traversal sequences directed at the readCanvas or writeCanvas functions. Third, the CanvasService.ts component evaluates the unvalidated path and executes file system operations outside the intended security sandbox.\nIn the context of the readCanvas function, this improper handling results in the retrieval and disclosure of arbitrary files accessible to the user running the server process. In the context of the writeCanvas function, it enables unauthorized modification, overwriting, or creation of files on the underlying file system, constrained only by the file system permissions of the executing process.\nThe affected component is version 1.0.0 of the bazylhorsey obsidian-mcp-server. The vulnerability requires local access vectors, does not involve complex network exposure, and relies on the local execution context to process the malicious path parameters."
}