Description

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T15:17:41.393Z",
  "pubdate": "2026-09-04T15:17:41.393Z",
  "executiveSummary": "firecrawl-mcp-server version 3.20.2 is susceptible to an arbitrary local file read vulnerability originating from insufficient input validation within the firecrawl_parse tool.\nThe vulnerability allows an attacker to bypass intended directory restrictions by providing malicious input via the filePath argument.\nBy leveraging directory traversal sequences or absolute file paths, unauthorized users can access sensitive system files, including configuration files, credentials, and environment variables.\nThe sensitive data retrieved through this exploitation is subsequently processed and returned within the model context, potentially exposing highly confidential information to the attacker.\nThis flaw presents a critical risk to data confidentiality, as it grants attackers the ability to exfiltrate system secrets without requiring high-level administrative privileges, provided the tool is accessible to the user.\nExploitation does not require complex infrastructure, relying solely on the ability to interact with the firecrawl_parse function with crafted input strings.",
  "technicalDetails": "The vulnerability resides in the firecrawl_parse tool component of firecrawl-mcp-server 3.20.2. The root cause is a failure to implement robust path sanitization and directory containment mechanisms when handling the filePath parameter.\nThe application processes the filePath argument provided by the user and proceeds to perform file system operations without verifying if the target file resides within an intended, restricted working directory or a safe sandbox.\nAttackers can exploit this by inputting directory traversal sequences (e.g., ../../../etc/passwd) or specifying absolute file paths (e.g., /etc/environment). Because the application lacks a validation layer to block these patterns or enforce a chroot-like environment, the underlying operating system resolves these paths, permitting the application to open and read files outside the intended scope.\nThe attack flow follows a direct path: 1) The attacker invokes the firecrawl_parse tool; 2) The attacker supplies a maliciously crafted filePath; 3) The server-side code performs a file read operation on the requested path; 4) The server retrieves the content of the target file; 5) The retrieved sensitive data is returned to the MCP context.\nThe exposure of environment variables is particularly severe, as these often contain API keys, database credentials, or secret tokens required for the operation of the application and its dependencies.\nBecause the server automatically feeds the contents of the read file into the model context, the exfiltration process is streamlined; the model effectively acts as a bridge to output the contents of sensitive files directly to the attacker's interface.\nThere are no complex requirements for exploitation beyond access to the tool itself. The vulnerability is local-path dependent but network-accessible in environments where the MCP server is exposed. No authentication is inherently required if the MCP endpoint is unprotected, and the attack executes within the context of the service account running the firecrawl-mcp-server process, inheriting its file system permissions."
}