CVE-2026-85661CWE-22path-traversal

CVE-2026-85661

Critical · published September 4, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00687 · 52.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-04T19:17Z
References (5)
https://github.com/haris-musa/excel-mcp-server · [email protected]https://github.com/haris-musa/excel-mcp-server/blob/v0.1.8/src/excel_mcp/server.py · [email protected]https://github.com/haris-musa/excel-mcp-server/blob/v0.1.8/src/excel_mcp/validation.py · [email protected]https://github.com/haris-musa/excel-mcp-server/issues/149 · [email protected]https://www.vulncheck.com/advisories/excel-mcp-server-0.1.8-arbitrary-file-read-write-via-stdio-mode · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 14:32Z
    excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode
    cvelistv5