Skip to content

Back to the catalog

vuldb.comadvisory

CVE-2026-85661 in excel-mcp-server

CVE-2026-85661 affects excel-mcp-server 0.1.8. In stdio mode with EXCEL_FILES_PATH unset, the server does not confine file paths, so a client can pass relative or absolute paths to the read and write tools. That gives arbitrary file read and write with the privileges of the server process. The page classifies it as CWE-22 (ATT&CK T1083) and recommends canonical path checks against a base directory, making EXCEL_FILES_PATH mandatory, and running with least privilege.

TL;DR excel-mcp-server 0.1.8 has no path confinement in stdio mode when EXCEL_FILES_PATH is unset (CVE-2026-85661), allowing arbitrary file read and write.
Open original ↗

Organisations named here

  • T1083

CVEs named here

  • CVE-2026-85661

Technologies named here

  • excel-mcp-server 0.1.8
  • VulDB
  • excel-mcp-server
  • Model Context Protocol

Techniques named here

  • CWE-22
  • T1083 File and Directory Discovery
  • Path traversal

Related in AppSec