CVE-2026-10278

MEDIUM

ishayoyo excel-mcp <= 1.0.2 - Path Traversal via filePath/outputPath Argument

Title source: llm

Description

A vulnerability was determined in ishayoyo excel-mcp up to 1.0.2. Impacted is an unknown function of the file src/index.ts of the component read_file/write_file. Executing a manipulation of the argument filePath/outputPath can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

References (6)

Core 6

Core References

Permissions Required, VDB Entry third-party-advisory

https://vuldb.com/submit/825418

Issue Tracking exploit issue-tracking

https://github.com/ishayoyo/excel-mcp/issues/6

Permissions Required, VDB Entry vdb-entry technical-description

https://vuldb.com/vuln/367571

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/vuln/367571/cti

Permissions Required, VDB Entry third-party-advisory

https://vuldb.com/cve/CVE-2026-10278

Various Sources product

https://github.com/ishayoyo/excel-mcp/

View Writeup ZIP pw:eip

Scores

CVSS v3 6.3

EPSS 0.0029

EPSS Percentile 20.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (3)

ishayoyo/excel-mcp 1.0.0

ishayoyo/excel-mcp 1.0.1

ishayoyo/excel-mcp 1.0.2

Published Jun 01, 2026

Tracked Since Jun 02, 2026