CVE-2026-7599: Dayoooun hwpx-mcp Path Traversal Flaw

CVE-2026-7599 Overview

CVE-2026-7599 is a path traversal vulnerability [CWE-22] affecting Dayoooun hwpx-mcp version 0.2.0. The flaw resides in the save_document, export_to_text, and export_to_html functions located in mcp-server/src/index.ts within the MCP Interface component. Manipulation of the output_path argument allows an authenticated remote attacker to write or export files outside intended directories. A public exploit exists, and the maintainer has not responded to the issue report at the time of disclosure.

Critical Impact
Remote attackers with low privileges can traverse directory paths through the output_path parameter to read, write, or overwrite files outside the intended workspace, impacting confidentiality, integrity, and availability of host data.

Affected Products

Dayoooun hwpx-mcp 0.2.0
Component: MCP Interface (mcp-server/src/index.ts)
Affected functions: save_document, export_to_text, export_to_html

Discovery Timeline

2026-05-01 - CVE-2026-7599 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7599

Vulnerability Analysis

The vulnerability stems from insufficient validation of the output_path argument passed to file-writing operations exposed by the Model Context Protocol (MCP) server. The save_document, export_to_text, and export_to_html handlers accept a caller-supplied path and use it to write content without normalizing or constraining the location to a designated working directory.

An authenticated remote client interacting with the MCP interface can supply traversal sequences such as ../ or absolute paths to direct output to arbitrary locations on the host filesystem. This allows arbitrary file write within the privileges of the MCP server process. The EPSS score for this vulnerability is 0.077% with a percentile of 22.749 as of 2026-05-07.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The export and save functions concatenate or pass through the output_path parameter directly to filesystem APIs in mcp-server/src/index.ts. No canonicalization, allowlist checks, or base-directory enforcement are applied before writing the file.

Attack Vector

Exploitation requires network access to the MCP server and low-privilege authentication. An attacker submits a tool invocation against save_document, export_to_text, or export_to_html with an output_path value containing traversal characters or an absolute path. The server writes the resulting document to the attacker-controlled location, which can include configuration files, startup scripts, or web-accessible directories.

The vulnerability mechanism is described in publicly available references. See the GitHub Issue Discussion and the VulDB Vulnerability Detail for further technical analysis. A public proof-of-concept is available in the Public Exploit Repository.

Detection Methods for CVE-2026-7599

Indicators of Compromise

MCP request payloads to save_document, export_to_text, or export_to_html containing ../, ..\, or absolute paths in the output_path argument.
Files written by the hwpx-mcp process outside its designated working directory, particularly in system, user profile, or web root locations.
Unexpected .hwpx, .txt, or .html files appearing in sensitive directories with timestamps matching MCP server activity.

Detection Strategies

Inspect MCP server logs for tool invocations where output_path contains traversal sequences or paths outside the configured workspace.
Monitor process file-write activity from the Node.js runtime hosting mcp-server/src/index.ts and alert on writes to non-allowlisted paths.
Apply file integrity monitoring on directories that should never receive output from the hwpx-mcp service.

Monitoring Recommendations

Enable verbose request logging on the MCP interface and forward logs to a centralized analytics platform for path-pattern analysis.
Baseline normal output_path values used by legitimate clients and alert on deviations.
Track child process and filesystem syscall telemetry from the hwpx-mcp service to identify writes outside the intended directory tree.

How to Mitigate CVE-2026-7599

Immediate Actions Required

Restrict network exposure of the hwpx-mcp server to trusted local clients until a fix is published.
Run the MCP server under a low-privilege user account with filesystem access limited to a dedicated working directory.
Apply OS-level mandatory access controls such as AppArmor, SELinux, or Windows ACLs to confine the process to allowed paths.
Audit existing exports and saves for files written outside expected locations.

Patch Information

No vendor patch is available at the time of publication. According to the GitHub Project Repository and the VulDB Submission Report, the maintainer was notified through an issue report but has not responded. Users should track the upstream repository for a fixed release and consider forking and patching the affected functions locally.

Workarounds

Wrap the save_document, export_to_text, and export_to_html handlers with a path-validation function that resolves the supplied output_path and rejects values that escape a configured base directory.
Reject any output_path argument containing .., null bytes, or absolute path prefixes before invoking filesystem APIs.
Disable or remove the affected tool handlers in mcp-server/src/index.ts if export functionality is not required.
Place the MCP server inside a container or chroot environment with no access to sensitive host paths.

bash

# Configuration example: restrict the hwpx-mcp service to a sandboxed directory
useradd -r -s /usr/sbin/nologin hwpxmcp
mkdir -p /var/lib/hwpx-mcp/output
chown hwpxmcp:hwpxmcp /var/lib/hwpx-mcp/output
chmod 750 /var/lib/hwpx-mcp/output

# Run the MCP server constrained to the working directory
sudo -u hwpxmcp HWPX_MCP_BASE_DIR=/var/lib/hwpx-mcp/output \
    node /opt/hwpx-mcp/mcp-server/src/index.ts