Description

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T15:17:43.643Z",
  "pubdate": "2026-09-04T15:17:43.643Z",
  "executiveSummary": "A path traversal vulnerability exists in excel-mcp-server version 0.1.8 due to improper input validation when the EXCEL_FILES_PATH environment variable is left unset.\nThe vulnerability allows an unauthenticated attacker to bypass intended file system boundaries, facilitating unauthorized read and write operations on arbitrary files within the host file system.\nThe impact is significant, as it grants attackers the ability to access sensitive configuration files, system data, or inject malicious content into files accessible to the process.\nThis vulnerability stems from a lack of path confinement logic in the application's stdio mode, effectively treating user-supplied file paths as trusted inputs.\nRisk implications include potential privilege escalation, data exfiltration, and arbitrary code execution depending on the nature of the files writable by the server process.\nExploitation requires the attacker to have the ability to supply input to the server's read and write tools, which is inherent in the stdio communication channel.",
  "technicalDetails": "The root cause of this vulnerability is the absence of a mandatory path validation or normalization mechanism when the EXCEL_FILES_PATH environment variable is undefined. In excel-mcp-server 0.1.8, the application relies on this environment variable to define a root directory for file operations. When this variable is absent, the server fails to enforce a fallback confinement policy.\nThe vulnerable component resides in the handling of file paths within the stdio mode. Because the application logic does not sanitize user-supplied paths to ensure they remain within a restricted directory, the file system API calls (such as 'fs.readFile' or 'fs.writeFile') interpret paths relative to the current working directory of the process, or as absolute paths if supplied by the attacker.\nExploitation occurs through the manipulation of arguments passed to the server's exposed tools. An attacker can supply path traversal sequences (e.g., '../../') or absolute file paths as arguments when invoking the read or write tools. Because the application logic fails to check if the resolved path originates from a trusted root directory, the underlying Node.js runtime executes the operation on the attacker-specified target.\nThe attack flow follows these steps: 1) The attacker initiates communication with the excel-mcp-server via stdio; 2) The attacker calls a file read or write tool, providing a payload containing a path that escapes the intended scope; 3) The application logic, lacking a bounds check, passes the raw path string directly to the file system interface; 4) The host operating system processes the request using the process's effective permissions; 5) The server returns the contents of the requested file or confirms the write operation to the attacker.\nThis vulnerability is particularly severe because the application operates with the permissions of the user running the process. If the process is running with elevated privileges or has access to sensitive files like '/etc/passwd' or system configuration files, the attacker can compromise the entire host environment. There is no requirement for prior authentication, as the stdio communication channel is assumed to be accessible by the invoking user."
}