Path Traversal Vulnerability in excel-mcp-server (CVE-2026-85661)

The excel-mcp-server package, specifically version 0.1.8, contains a critical path traversal vulnerability (CVE-2026-85661) arising from improper validation of file paths when the EXCEL_FILES_PATH environment variable is not explicitly configured in stdio mode. Because the application fails to enforce directory confinement under these conditions, it inadvertently allows any input provided to its file-related tools to resolve to arbitrary locations on the underlying host filesystem. An attacker capable of interacting with the server's MCP tools can exploit this to read sensitive configuration files, modify application data, or potentially write malicious payloads to system directories, effectively inheriting the permissions of the service process.

Impact

Successful exploitation allows for full file system access within the context of the service user. This poses a significant risk of data exfiltration and persistent system compromise, particularly in environments where the service is running with elevated or overly permissive account privileges.

Recommendation

• Immediately upgrade to a patched version of excel-mcp-server when available.
• Explicitly define the EXCEL_FILES_PATH environment variable in all deployments to restrict the service to a designated, hardened directory.
• Audit filesystem logs for unexpected file access patterns originating from the process executing the excel-mcp-server instance.