CVE-2026-10278
Description
Path traversal in ishayoyo excel-mcp up to 1.0.2 allows remote attackers to read or write arbitrary files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Path traversal in ishayoyo excel-mcp up to 1.0.2 allows remote attackers to read or write arbitrary files.
Vulnerability
A path traversal vulnerability exists in ishayoyo excel-mcp up to version 1.0.2. The component read_file/write_file within src/index.ts improperly handles file path arguments like filePath and outputPath. These arguments are used to access the local filesystem without proper sanitization or directory restrictions, allowing for path traversal [1].
Exploitation
An attacker can exploit this vulnerability by invoking the affected MCP tools, such as read_file or write_file. The attacker needs to manipulate the filePath or outputPath arguments to point to arbitrary locations on the filesystem. The target file must be readable by the process for read operations, and the target path must be writable by the process for write operations [1]. The attack can be launched remotely [1].
Impact
Successful exploitation allows an attacker to read arbitrary spreadsheet files that are accessible by the server process. Additionally, an attacker can write CSV or XLSX files to any location writable by the server process. This could lead to sensitive information disclosure or arbitrary file overwrite, depending on the attacker's objective and the server process's privileges [1].
Mitigation
As of the report date, a fixed version for this vulnerability is not available. The project was informed of the issue but has not yet responded. Users are advised to monitor the project's repository for updates or patches [1].
AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The application resolves caller-controlled file path arguments without enforcing a workspace root, allowing path traversal."
Attack vector
An attacker can invoke affected MCP tools, such as read_file or write_file, remotely. By manipulating arguments like `filePath` or `outputPath`, the attacker can specify arbitrary paths on the server's filesystem. This allows for reading existing spreadsheet files or writing new CSV/XLS/XLSX files to locations outside the intended directory. The attack requires the attacker to be able to invoke the MCP tools and for the target file to be readable or the target path to be writable by the server process [ref_id=1].
Affected code
The vulnerability resides in the handling of file path arguments within the `src/index.ts` file. These arguments are passed to file read/write APIs in `src/utils/file-utils.ts` and `src/handlers/file-operations.ts`, specifically functions like `fs.readFile`, `workbook.xlsx.readFile`, `fs.writeFile`, and `workbook.xlsx.writeFile`, without proper path validation [ref_id=1].
What the fix does
The advisory recommends implementing a required configured workspace root and enforcing path containment after `path.resolve`. It also suggests rejecting absolute paths unless explicitly enabled by trusted configuration and adding regression tests to prevent paths outside the workspace from being accessed. No patch is publicly available at this time [ref_id=1].
Preconditions
- inputAttacker can invoke the affected MCP tools (e.g., read_file, write_file).
- inputFor reading, the target file must be a supported spreadsheet/CSV type and readable by the process.
- inputFor writing, the target path must be writable by the process.
Reproduction
```json {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"read_file","arguments":{"filePath":"C:\\Users\\czx\\Desktop\\cve\\excel-read-test.csv"}}} {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"write_file","arguments":{"filePath":"C:\\Users\\czx\\Desktop\\cve\\excel-write-test.csv","headers":["a","b"],"data":[["1","2"]]}}} ``` Confirm that `read_file` returns the contents of the selected local CSV file. Confirm that `write_file` creates the selected local CSV file outside the repository directory [ref_id=1].
Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5News mentions
0No linked articles in our index yet.