CVE-2026-10278: ishayoyo excel-mcp Path Traversal Flaw

CVE-2026-10278 Overview

CVE-2026-10278 is a path traversal vulnerability in ishayoyo excel-mcp versions up to 1.0.2. The flaw resides in an unknown function within src/index.ts that handles the read_file and write_file operations. An attacker who can supply values for the filePath or outputPath arguments can manipulate them to escape the intended working directory and access or overwrite files elsewhere on the host. The issue is classified as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The exploit has been publicly disclosed, and the project maintainers have not yet responded to the initial issue report.

Critical Impact
Remote authenticated attackers can read or write arbitrary files on systems running excel-mcp through 1.0.2 by manipulating filePath or outputPath arguments.

Affected Products

ishayoyo excel-mcp 1.0.0
ishayoyo excel-mcp 1.0.1
ishayoyo excel-mcp 1.0.2

Discovery Timeline

2026-06-01 - CVE-2026-10278 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10278

Vulnerability Analysis

The vulnerability affects the Model Context Protocol (MCP) server implementation in excel-mcp, a tool that exposes Excel file operations to AI clients. The read_file and write_file tool handlers accept user-controlled filePath and outputPath arguments and pass them to file system operations without sufficient normalization or containment checks. By embedding traversal sequences such as ../ or by supplying absolute paths, an attacker can direct the server to read or write files outside any intended working directory. Because MCP servers commonly run with the privileges of the invoking user or service account, the impact can extend to configuration files, credentials, and other sensitive data accessible to that account.

Root Cause

The root cause is missing path canonicalization and boundary enforcement in the file argument handling logic of src/index.ts. The handler does not resolve the supplied path and verify that the result remains within an allowlisted base directory before invoking file I/O routines.

Attack Vector

The attack is network-reachable and requires low-level privileges to interact with the MCP server. An attacker invokes the read_file tool with a crafted filePath such as ../../etc/passwd to read sensitive files, or invokes write_file with a crafted outputPath to overwrite arbitrary files. The EPSS score is 0.051% (16.221 percentile), indicating low predicted exploitation activity at this time, but a public proof of concept exists.

No verified exploit code is reproduced here. See the GitHub Issue Tracker and the VulDB Vulnerability Details for the public disclosure.

Detection Methods for CVE-2026-10278

Indicators of Compromise

File access or write events originating from the excel-mcp process targeting paths outside the expected Excel working directory.
MCP request payloads containing ../, ..\, or absolute paths in the filePath or outputPath parameters of read_file or write_file calls.
Unexpected modifications to system files, dotfiles, or configuration files under user home directories on hosts running the server.

Detection Strategies

Inspect MCP server logs for read_file and write_file invocations and flag arguments containing traversal sequences or absolute path prefixes.
Apply file integrity monitoring to directories that should never be touched by excel-mcp, such as /etc, ~/.ssh, and credential stores.
Correlate process telemetry from the Node.js runtime hosting excel-mcp with file open and write syscalls outside the documented working directory.

Monitoring Recommendations

Enable verbose request logging on the MCP server and centralize logs for review.
Alert on any write operations by the excel-mcp process to files outside an explicit allowlist.
Track outbound exfiltration patterns following anomalous read_file calls that returned non-Excel content.

How to Mitigate CVE-2026-10278

Immediate Actions Required

Restrict network exposure of the excel-mcp server to trusted local clients only until a fix is available.
Run the server under a low-privileged service account with file system access scoped to a dedicated Excel working directory.
Audit recent read_file and write_file invocations for traversal patterns and treat any matches as suspected compromise.

Patch Information

No vendor patch is available at the time of publication. The maintainers of ishayoyo/excel-mcp have not responded to the upstream issue report referenced in the disclosure. Track the GitHub Issue Tracker and the GitHub PoC Repository for updates beyond version 1.0.2.

Workarounds

Wrap excel-mcp behind a proxy or policy layer that rejects MCP requests whose filePath or outputPath arguments contain .., null bytes, or absolute path prefixes.
Use operating system controls such as a chroot, container, or mandatory access control profile to confine the server process to a single directory.
Disable the read_file and write_file tools entirely if they are not required by the client workflow.

bash

# Configuration example - run excel-mcp inside a confined directory
mkdir -p /srv/excel-mcp/data
chown excelmcp:excelmcp /srv/excel-mcp/data
chmod 750 /srv/excel-mcp/data

# Launch under a dedicated user, restricted to the data directory
sudo -u excelmcp \
  systemd-run --uid=excelmcp --gid=excelmcp \
    --property=ProtectSystem=strict \
    --property=ReadWritePaths=/srv/excel-mcp/data \
    --property=PrivateTmp=yes \
    node /opt/excel-mcp/dist/index.js