CVE-2026-40576

OVERVIEW CVE-2026-40576 is a critical path traversal vulnerability affecting excel-mcp-server versions up to 0.1.7. The flaw exists in the get_excel_path() function, which fails to properly validate and confine file operations within the intended EXCEL_FILES_PATH directory. When deployed in SSE or Streamable-HTTP transport modes, unauthenticated network attackers can exploit this vulnerability through 25 exposed MCP tool handlers to read, write, and overwrite arbitrary files on the host system. SEVERITY The vulnerability carries a CVSS 3.1 score of 9.4 (CRITICAL), with a network attack vector, low complexity, and requiring no authentication or user interaction. The primary flaw stems from two independent validation failures: the function accepts absolute paths without restriction and processes relative paths without proper resolution or validation. Combined with the default network configuration of 0.0.0.0 binding address and zero authentication on network-facing transports, this creates a trivial exploitation pathway. The impact encompasses confidentiality loss, high integrity compromise (file modification), and high availability impact through file deletion or system manipulation. EXPLOITATION STATUS There is no current evidence of active exploitation in the wild, as indicated by the absence of KEV (Known Exploited Vulnerability) designation and inactive status on the Hot List. However, the straightforward nature of the vulnerability and availability of file manipulation tools suggest exploitation remains feasible. The vulnerability has been patched in version 0.1.8, and immediate remediation is strongly recommended for all affected deployments.