Description

A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyze_csv_data MCP tool. This manipulation of the argument filename causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-20T17:16:52.190Z",
  "pubdate": "2026-09-20T17:16:52.190Z",
  "executiveSummary": "A critical path traversal vulnerability has been identified in the mcp-file-analyzer component of 00Kisumi00's project. The vulnerability resides within the analyze_csv_data MCP tool, specifically in the ControlFlowNode function of main.py.\nThis flaw allows a remote attacker to manipulate the filename argument to bypass directory restrictions and access unauthorized files on the underlying filesystem. Because the application processes user-supplied input without adequate sanitization, an attacker can traverse out of the intended working directory to read sensitive files.\nThe vulnerability is currently unpatched and publicly documented, significantly increasing the risk of exploitation. Given the nature of MCP (Model Context Protocol) tools, which often interact directly with local file systems to facilitate LLM operations, successful exploitation could lead to full information disclosure, including the retrieval of source code, configuration files, or environment variables. No authentication or elevated privileges are explicitly required to trigger this path traversal, making it a high-risk security concern for any environment deploying this tool.",
  "technicalDetails": "The vulnerability is rooted in an improper neutralization of special elements used in a file path (CWE-22/CWE-23) within the ControlFlowNode function in main.py. The application fails to validate the user-provided filename input before performing file system operations, allowing the use of directory traversal sequences such as '../'.\nTechnical root cause analysis indicates that the input argument for the filename is passed directly to a file-handling API or library without verifying if the resulting path remains within the designated safe directory context. By crafting a malicious input string, such as '../../../../etc/passwd', an attacker can escape the intended root directory.\nThe attack flow proceeds as follows: 1. The attacker identifies the analyze_csv_data MCP tool as the entry point. 2. The attacker submits a specially crafted request containing a malicious filename parameter, incorporating traversal sequences. 3. The ControlFlowNode function processes the payload and concatenates it with the base directory path without sanitization or canonicalization checks. 4. The underlying file system operation resolves the path to an unauthorized target file. 5. The content of the unauthorized file is read and potentially returned to the attacker or leaked through the tool's output mechanism.\nThe component affected is the analyze_csv_data tool within the mcp-file-analyzer repository, specifically affecting versions up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. The vulnerability is exploitable remotely, as the MCP interface exposes the function for interaction. No specific authentication is documented as a barrier to exploitation, assuming the tool is reachable via the connected client or server implementation.\nPost-exploitation impact is significant; an attacker can perform unauthorized arbitrary file read operations, potentially exposing sensitive system information or application secrets stored within the server's file system. As the project follows a rolling release model and remains unpatched, environments relying on this code are at constant risk. The existence of public exploit material further lowers the barrier to entry for potential adversaries."
}