rootpwn

medium · CVSS v3 4.3 · CVSS v4 5.3

CVE-2026-94037

The CVE-2026-94037 vulnerability in the 00Kisumi00 mcp-file-analyzer allows attackers to perform path traversal by manipulating the filename

Overview

The CVE-2026-94037 vulnerability in the 00Kisumi00 mcp-file-analyzer allows attackers to perform path traversal by manipulating the filename argument in the ControlFlowNode function. This flaw can be exploited remotely to read or write arbitrary files on the host. The issue remains unpatched as the project has not released a fix.

Description

A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyze_csv_data MCP tool. This manipulation of the argument filename causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Impact

The vulnerability compromises confidentiality by allowing attackers to read sensitive files, integrity by enabling modification of arbitrary files, and availability if the attacker writes malicious files that disrupt the tool. Defenders should be aware that any system running the affected mcp-file-analyzer could be compromised, especially if the tool processes untrusted input.

Remediation

Apply the latest release once available, or manually patch the ControlFlowNode function to validate the filename path and restrict it to a safe directory. In the interim, restrict file system permissions for the user running the tool and monitor for suspicious file access. Consider disabling the analyze_csv_data component if not needed.

Risk context

Medium severity with CVSS 4.3/5.3 and no EPSS data. The public availability of an exploit and lack of a patch increase the risk, so defenders should treat this as a moderate but actionable threat.

Affected products

  • 00Kisumi00 mcp-file-analyzer
  • mcp-file-analyzer
  • analyze_csv_data MCP tool
  • MCP tool

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
5.3
EPSS
—

path-traversal file-access remote-exploitation mcp-file-analyzer medium-severity vulnerability defense

← All CVEs

Related CVEs

medium

CVE-2026-94032

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-93956

A medium‑severity XSS flaw exists in olivier-ls PHP‑FTS up to 1.1.2. The vulnerability is triggered by manipulating the Query argument to SearchEngine::buildHighlights, allowing remote attackers to inject malicious scripts. It can be exploited via a web request to the affected component.

View analysis

medium

CVE-2026-92410

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

View analysis

medium

CVE-2026-92422

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.

View analysis