# excel-mcp-server has a Path Traversal issue

excel-mcp-server's get_excel_path() accepted absolute paths and unvalidated ../ joins, letting unauthenticated network clients read/write/overwrite arbitrary files via any of 25 MCP tools.

- Payout: Research
- Severity: critical
- Program: excel-mcp-server
- Found by: hits313
- Disclosed: 2026-04-14
- CVE: CVE-2026-40576
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-j98m-w3xp-9f56
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-j98m-w3xp-9f56
- Tags: area:ai domain:ai domain:network impact:data-leak impact:dos impact:integrity kind:research platform:ghsa sev:critical tech:python technique:source-review vuln:auth-bypass vuln:path-traversal

**Target:** MCP server (SSE / Streamable-HTTP transport) file-handling tool handlers
**Root cause:** get_excel_path() returns absolute paths unchanged and joins relative paths to EXCEL_FILES_PATH without realpath/commonpath validation, so neither absolute paths nor ../ sequences are confined to the sandbox.
**Steps:**
1. Start server: `EXCEL_FILES_PATH=/tmp/sandbox FASTMCP_HOST=127.0.0.1 FASTMCP_PORT=8017 excel-mcp-server streamable-http`
2. Connect to the MCP endpoint with no credentials; 25 tools are exposed
3. Call `create_workbook`/`write_data_to_excel` with `filepath` set to an absolute path outside the sandbox (e.g. `/tmp/cve-hunt/outside_sandbox/P1_absolute_write.xlsx`)
4. Call with a traversal path like `../../etc/passwd`-style relative path to escape via `os.path.join`
5. Call `read_data_from_excel` with an absolute path to exfiltrate victim .xlsx contents
6. Call `write_data_to_excel` on a victim file to overwrite its contents
**How found:** Code review of get_excel_path() in src/excel_mcp/server.py: noticed the isabs() early-return and the bare os.path.join() with no realpath/commonpath check, then confirmed every @mcp.tool() handler calls it first.
**Exploitation:** Unauthenticated attacker reaching port 8017 calls any MCP tool with a crafted filepath: absolute paths bypass the sandbox, ../ escapes it. Demonstrated primitives: write outside sandbox, traversal write, arbitrary mkdir tree, read/exfiltrate SSN data, overwrite victim file, stat arbitrary path. All 7 tests confirmed against a live instance.
**Escalation:** Arbitrary directory creation plus write-anywhere enables planting macro-enabled .xltm templates at shared paths for client-side RCE when a downstream user opens them; repeated writes can fill disk for DoS.
**Insight:** MCP servers in remote transport mode often inherit stdio-era trust assumptions: check whether path-confinement helpers special-case absolute paths and whether the default bind is 0.0.0.0 with no auth — every tool handler sharing one helper means one flaw compromises the whole API surface.