VulnSocial

CVE-2026-85661General

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-07); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-07: 1Mentions · 2026-09-10: 1Technical Details · 2026-09-07: 1Technical Details · 2026-09-10: 109-0709-10
Signal classification2 categories
General
150.0%
Disclosure
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-09-071
General1
2026-09-101
Disclosure1
Full discourse2 posts
  • Christopher Elliott@Chris_L_Elliott
    Disclosure

    @DFIR_Lab Same VulnCheck batch: excel-mcp-server path escape when EXCEL_FILES_PATH is unset (CVE-2026-85661, 9.8) and firecrawl-mcp local file read (CVE-2026-85606). “Scoped path” needs runtime checks, not README vibes.

    Post summary

    The tweet announces two vulnerabilities—CVE‑2026‑85661 (path escape) and CVE‑2026‑85606 (local file read)—in Excel‑mcp‑server and firecrawl‑mcp, noting a 9.8 CVSS score, but offers no PoC, exploit tool, or patch information.

    0000037
    48 followersView on X
  • Cybersecurity News DE@cybsecuritynews
    General

    #schwachstellen Kritische Lücke in excel-mcp-server erlaubt Datei-Zugriff außerhalb des erlaubten Pfads #018 #cve202685661 #excelmcpserver https://cybersecurity-news.de/cve-2026-85661-excel-mcp-server-dateizugriff

    Post summary

    A security news link reports a critical path‑traversal vulnerability in the Excel MCP Server that permits file access beyond the intended directory, but offers no PoC, exploit details, or patch information.

    0000028
    12 followersView on X

Explore more

Back to dashboard