CVE-2026-79622: Adobe XD MCP Path Traversal Vulnerability

CVE-2026-79622 Overview

CVE-2026-79622 is a path traversal vulnerability in dekdee adobe-xd-mcp version 1.0.0. The flaw resides in an unknown function within src/parsers/xd-parser.ts, part of the file-access-from-request endpoint. Attackers manipulate the outputFile or outputDir arguments to write files outside the intended directory. The attack is executable remotely and requires no authentication or user interaction. Public exploit details are available, and the maintainer has been notified through a GitHub issue but has not yet responded. This weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Remote attackers can traverse the filesystem via crafted outputFile or outputDir parameters, resulting in arbitrary file writes outside the intended directory in a Model Context Protocol (MCP) server integrated with Adobe XD.

Affected Products

dekdee adobe-xd-mcp 1.0.0
Component: src/parsers/xd-parser.ts
Endpoint: file-access-from-request

Discovery Timeline

2026-08-25 - CVE-2026-79622 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79622

Vulnerability Analysis

The vulnerability affects adobe-xd-mcp, a Model Context Protocol (MCP) server that exposes Adobe XD parsing functions to AI clients. The file-access-from-request endpoint accepts outputFile and outputDir arguments from remote callers. The parser in src/parsers/xd-parser.ts passes these values into filesystem write operations without sanitizing directory separators or parent-directory references. An attacker submits values such as ../../etc/passwd or absolute paths to escape the intended output directory. Because MCP servers often run with the privileges of the local user connecting an AI assistant, successful traversal can overwrite configuration files, drop payloads in autorun locations, or corrupt project data. Public disclosure of the exploit increases the likelihood of opportunistic scanning against exposed MCP endpoints.

Root Cause

The root cause is missing input validation on the outputFile and outputDir arguments before they are joined into filesystem paths. The parser trusts caller-supplied values instead of canonicalizing the resolved path and confirming it stays within an allow-listed base directory. This maps directly to CWE-22.

Attack Vector

An unauthenticated remote attacker sends a crafted request to the file-access-from-request endpoint with a manipulated outputFile or outputDir argument containing traversal sequences. The MCP server resolves the path relative to its working directory and writes attacker-controlled content to a location outside the intended scope. No user interaction is required. Refer to the GitHub issue #3 for adobe-xd-mcp and the VulDB entry for CVE-2026-79622 for reported technical details.

// No verified proof-of-concept code is published in the CVE record.
// See the referenced GitHub issue and VulDB advisory for technical details.

Detection Methods for CVE-2026-79622

Indicators of Compromise

Requests to the adobe-xd-mcp file-access-from-request endpoint containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths in outputFile or outputDir parameters.
Files created by the adobe-xd-mcp process outside its configured project output directory, including writes to user profile, startup, or system configuration paths.
Unexpected modifications to files owned by the account running the MCP server, with timestamps aligned to MCP request logs.

Detection Strategies

Inspect MCP server logs for outputFile and outputDir argument values and flag any containing directory traversal sequences or absolute path prefixes.
Monitor process file-write telemetry from the Node.js process hosting adobe-xd-mcp and alert on writes outside the declared project directory.
Compare the canonical resolved path of write operations against an allow-listed base directory using host-based file integrity monitoring.

Monitoring Recommendations

Enable verbose request logging on the adobe-xd-mcp process and forward logs to a centralized analytics platform for retention and search.
Alert on outbound connections from developer workstations to unfamiliar MCP clients that then trigger local file writes.
Track version metadata for adobe-xd-mcp installations across developer endpoints to identify vulnerable 1.0.0 deployments.

How to Mitigate CVE-2026-79622

Immediate Actions Required

Stop or uninstall adobe-xd-mcp 1.0.0 instances that are reachable from untrusted networks or clients until a patched release is available.
Bind the MCP server to 127.0.0.1 only and require an authenticated local client, since the endpoint accepts remote input by default.
Audit the output directories used by adobe-xd-mcp for files that were written outside expected paths and remove any anomalous artifacts.

Patch Information

No vendor patch is available at the time of publication. The project was notified through GitHub issue #3 but has not responded. Monitor the adobe-xd-mcp repository for a fixed release. When a patch is published, verify that outputFile and outputDir are canonicalized and validated against an allow-listed base directory.

Workarounds

Run adobe-xd-mcp inside a container or sandbox with a read-only filesystem and a single writable mount scoped to the intended output directory.
Enforce a filesystem access-control policy that denies the MCP process write access to home directory dotfiles, startup folders, and system paths.
Add a reverse proxy in front of the MCP endpoint that rejects requests containing ../, ..\, encoded traversal sequences, or absolute paths in JSON parameter values.

bash

# Example: restrict adobe-xd-mcp to loopback and a scoped output directory
# Bind MCP to localhost only
export MCP_BIND_ADDRESS=127.0.0.1

# Run inside a container with a scoped writable mount
docker run --rm \
  --read-only \
  --network=host \
  -v "$PWD/xd-output:/app/output:rw" \
  -e OUTPUT_DIR=/app/output \
  adobe-xd-mcp:1.0.0