GHSA-j98m-w3xp-9f56: excel-mcp-server has a Path Traversal issue
SummaryA path traversal vulnerability exists in [`excel-mcp-server`](https://github.com/haris-musa/excel-mcp-server) versions up to and including `0.1.7`. When running in SSE or Streamable-HTTP transport mode (the documented way to use this server remotely), an unauthenticated attacker on the network can read, write, and overwrite arbitrary files on the host filesystem by supplying crafted `filepath` arguments to any of the 25 exposed MCP tool handlers.The server is intended to confine file operations to a directory set by the `EXCEL_FILES_PATH` environment variable. The function responsible for enforcing this boundary — `get_excel_path()` — fails to do so due to two independent flaws: it passes absolute paths through without any check, and it joins relative paths without resolving or validating the result. Combined with zero authentication on the default network-facing transport and a default bind address of `0.0.0.0` (all interfaces), this allows trivial remote exploitation.Details| Field | Value |
|-------|-------|
| **Package** | [`excel-mcp-server`](https://pypi.org/project/excel-mcp-server/) (PyPI) |
| **Repository** | https://github.com/haris-musa/excel-mcp-server |
| **Affected versions** | `<= 0.1.7` |
| **Tested version** | `0.1.7` — commit [`de4dc75`](https://github.com/haris-musa/excel-mcp-server/commit/de4dc75f6ba629ccd2e097f5963235846be622e6) |
| **CWE** | [CWE-22](https://cwe.mitre.org/data/definitions/22.html) — Improper Limitation of a Pathname to a Restricted Directory |
| **CVSS 3.1** | **8.2 High** — `AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H` |
| **Transports affected** | `sse`, `streamable-http` (network-facing) |
| **Authentication required** | **None** |Vulnerable CodeThe root cause is in `src/excel_mcp/server.py`, lines 75–94:Why this is exploitable**Flaw 1 — Absolute path bypass (line 86):**
If the attacker passes `filepath="/etc/shadow"` or `filepath="/home/user/secrets.xlsx"`, the function returns it unchanged. The sandbox directory `EXCEL_FILES_PATH` is never consulted.**Flaw 2 — Relative traversal (line 94):**
`os.path.join("/srv/sandbox", "../../etc/passwd")` produces `"/srv/sandbox/../../etc/passwd"`, which resolves to `"/etc/passwd"`. No `os.path.realpath()` or `os.path.commonpath()` check is performed, so `../` sequences escape the sandbox.Contributing factors that increase severity**Default bind address is `0.0.0.0`** (all interfaces) — `server.py` line 70:A user who follows the README and runs `uvx excel-mcp-server streamable-http` without explicitly setting `FASTMCP_HOST` exposes the server to their entire LAN.**Zero authentication** — FastMCP's SSE and Streamable-HTTP transports ship with no authentication. The server adds none. Any TCP client that reaches port 8017 can call any tool.**All 25 tool handlers are affected** — every `@mcp.tool()` decorated function calls `get_excel_path(filepath)` as its first action. This is not an isolated endpoint; it is the entire API surface.**Arbitrary directory creation** — `src/excel_mcp/workbook.py` line 24 runs `path.parent.mkdir(parents=True, exist_ok=True)` before saving, meaning the attacker can create directory trees at any writable location.Proof of ConceptVideo demonstration[![asciicast](https://asciinema.org/a/2HVA3uKvVeFahIXY.svg)](https://asciinema.org/a/2HVA3uKvVeFahIXY)**asciinema recording:** https://asciinema.org/a/2HVA3uKvVeFahIXYI have also attached the full PoC shell script (`record-poc.sh`) and the Python exploit script (`exploit_test.py`) to a Google Drive for the maintainer to review and reproduce independently:**Google Drive (PoC scripts):**  Shared privately via emailContents:`record-poc.sh` — automated PoC recording script (bash)`exploit_test.py` — Python exploit that tests all 7 primitives against a running serverSetupExploit scriptThe following Python script connects to the server with zero credentials and demonstrates all exploitation primitives:{REMOVING CAUSE FOR SAFETY CONCERNS}ResultsAll 7 test cases passed against a live server instance:Filesystem evidence (independently verified after exploit)**Files created outside the sandbox:****Attacker-created directory tree:****Victim file after overwrite (original SSN destroyed):**ImpactAn unauthenticated network attacker can:| What | How | Severity |
|------|-----|----------|
| **Read any `.xlsx` file** on the host | Supply absolute path to `read_data_from_excel` | Confidentiality loss — cross-tenant data theft of financial data, HR records, reports |
| **Write `.xlsx` files anywhere** on the filesystem | Supply absolute path or `../` traversal to `create_workbook` or `write_data_to_excel` | Integrity loss — destroy or corrupt any writable `.xlsx`, plant malicious files |
| **Create arbitrary directories** anywhere writable | `create_workbook` triggers `mkdir(parents=True)` on attacker-controlled path | Precursor to privilege escalation or DoS |
| **Overwrite existing business files** with attacker content | `write_data_to_excel` with absolute path to target | Silent data corruption — audit reports, salary sheets, financial models |
| **Fill disk** via repeated writes | Loop `create_workbook` with unique filenames | Denial of service — crash services dependent on free disk |
| **Plant macro-enabled templates** (`.xltm`) at known shared paths | `create_workbook` at path like `/home/user/Templates/report.xltm` | Client-side RCE chain when downstream user opens the template in Excel |Who is affectedAnyone running `excel-mcp-server` in SSE or Streamable-HTTP mode on a reachable network — which is the documented and recommended deployment for remote use. The project README explicitly states:*"Works both locally and as a remote service"**"Streamable HTTP Transport (Recommended for remote connections)"*The server has **3,655+ GitHub stars** and is published on **PyPI** with active downloads.Suggested FixReplace `get_excel_path()` with a version that enforces the sandbox boundary:References[CWE-22: Improper Limitation of a Pathname to a Restricted Directory](https://cwe.mitre.org/data/definitions/22.html)[OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)[Model Context Protocol Specification](https://modelcontextprotocol.io/)[FastMCP Documentation](https://github.com/jlowin/fastmcp)
CVSS v3.1: 9.4