VulnSocial

CVE-2026-85606Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-10: 2Patch / Workaround · 2026-09-10: 1Technical Details · 2026-09-10: 209-10
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Full discourse2 posts
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH SEVERITY: CVE-2026-85606 (CVSS 7.5) firecrawl-mcp-server 3.20.2 vulnerable to arbitrary local file read via path traversal (CWE-22). Attackers can read credentials & env vars without authentication. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/ZNhCMVNKOb

    Post summary

    The tweet alerts to a high‑severity CVE-2026-85606 affecting firecrawl‑mcp‑server v3.20.2 with a path traversal based file read flaw, and calls for immediate patching.

    2000059
    130 followersView on X
  • Christopher Elliott@Chris_L_Elliott
    Disclosure

    @DFIR_Lab Same VulnCheck batch: excel-mcp-server path escape when EXCEL_FILES_PATH is unset (CVE-2026-85661, 9.8) and firecrawl-mcp local file read (CVE-2026-85606). “Scoped path” needs runtime checks, not README vibes.

    Post summary

    The post discloses two high‑severity vulnerabilities (CVE‑2026‑85661 and CVE‑2026‑85606) and recommends implementing runtime path checks.

    0000037
    48 followersView on X

Explore more

Back to dashboard