Description

A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function get_file_snippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. isPathInsideProjectRoot only blocks filePath escaping the attacker-chosen projectRootPath; the root itself is untrusted client input - set projectRootPath=/etc, filePath=hosts and the guard passes. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-20T19:17:13.317Z",
  "pubdate": "2026-09-20T19:17:13.317Z",
  "executiveSummary": "A path traversal vulnerability exists in the 0215AndrewFeng ACE-MCP component, specifically within the get_file_snippet function of getFileSnippet.ts.\nThe vulnerability arises from improper validation of client-supplied input for projectRootPath and filePath parameters, which allows an attacker to bypass security checks.\nBy manipulating these inputs, a remote attacker can read arbitrary files on the underlying filesystem that the application process has access to.\nThis vulnerability is critical as it permits unauthorized file disclosure, potentially exposing sensitive system configuration, credentials, or source code.\nThe flaw stems from the failure of the isPathInsideProjectRoot guard to validate the projectRootPath itself, effectively treating it as a user-controlled variable rather than a trusted, hardcoded directory.\nPublicly available exploit code increases the risk of exploitation for unpatched systems running version 4.10.8 or earlier.",
  "technicalDetails": "The vulnerability resides within the get_file_snippet function located in getFileSnippet.ts. The function is designed to read and return snippets of files requested by the client via the MCP Tool.\nThe root cause is a flaw in the input validation logic where the security mechanism intended to restrict file access—the isPathInsideProjectRoot helper—is fundamentally misconfigured.\nWhile the function attempts to ensure that the filePath resides within the designated projectRootPath, it fails to sanitize or validate the projectRootPath parameter itself. Because both parameters are accepted as untrusted client input, an attacker can designate an arbitrary directory on the filesystem as the project root.\nFor example, by setting the projectRootPath to '/etc' and the filePath to 'hosts', the path concatenation logic results in a path that resides within the scope of the projectRootPath, successfully bypassing the boolean check of the isPathInsideProjectRoot function.\nThe attack flow involves: 1) The attacker transmits a crafted request to the MCP Tool containing a malicious projectRootPath (e.g., a system directory) and a target filePath. 2) The server-side code concatenates these values without verifying that projectRootPath points to a legitimate or intended directory. 3) The validation guard is invoked, which confirms that the resulting path is technically 'inside' the malicious root. 4) The get_file_snippet function proceeds to read the contents of the target file using file system APIs. 5) The sensitive file contents are returned in the response to the remote attacker.\nThis vulnerability is remotely exploitable without requiring authentication, allowing any actor capable of communicating with the MCP component to access files across the host filesystem. The impact is significant, as it facilitates the retrieval of sensitive environment files, private keys, or application secrets, leading to potential complete compromise of the system depending on the permissions of the user running the ACE-MCP service."
}