CVE-2026-94037 Details

A path traversal vulnerability has been identified in the 00Kisumi00 mcp-file-analyzer application, specifically in the analyze_csv_data tool. This vulnerability affects all versions prior to the commit 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. The issue arises in the ControlFlowNode function within main.py, where the tool improperly validates the filename argument. This lack of validation allows an attacker to manipulate the path, escaping the intended data directory and potentially accessing sensitive files. The vulnerability can be exploited remotely, and a public exploit is available.

To address this vulnerability, it is recommended to implement proper path validation by resolving both the DATA_DIR and the user-supplied filename to canonical absolute paths. The application should reject absolute paths and traversal sequences, ensuring that the resolved path remains within the intended data directory before accessing the file. Additionally, the server should be run with least-privilege filesystem permissions to minimize potential damage from exploitation.