CVE-2026-81485 Overview
CVE-2026-81485 is a path traversal vulnerability [CWE-22] in danielpopamd/linkedin-ads-mcp version 1.0.0. The flaw resides in the Media Upload component, specifically in the fs.readFileSync call within src/tools/campaign-management.ts. Attackers can manipulate the filePath argument to read files outside the intended directory. The attack is exploitable remotely and the exploit has been disclosed publicly. The maintainer was notified through a public issue report but has not responded at the time of disclosure.
Critical Impact
Remote attackers can traverse the file system through an unsanitized filePath parameter in the Media Upload handler, exposing arbitrary files readable by the MCP server process.
Affected Products
- danielpopamd/linkedin-ads-mcp 1.0.0
- Component: Media Upload (src/tools/campaign-management.ts)
- Affected function: fs.readFileSync
Discovery Timeline
- 2026-08-27 - CVE-2026-81485 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-81485
Vulnerability Analysis
The linkedin-ads-mcp project implements a Model Context Protocol (MCP) server that exposes tools for managing LinkedIn Ads campaigns. The Media Upload tool accepts a filePath argument and reads the referenced file with fs.readFileSync before uploading its contents. Because the handler does not normalize or constrain the supplied path, callers can supply relative traversal sequences such as ../../etc/passwd or absolute paths to escape the intended media directory. The server then returns or transmits the contents of the referenced file. Exploitation requires no authentication and no user interaction against the MCP endpoint. The public disclosure includes reproduction details in the referenced GitHub issue.
Root Cause
The root cause is missing input validation and path canonicalization on the filePath argument before invocation of fs.readFileSync. The handler does not resolve the input against an allowlisted base directory nor reject paths containing .. segments or absolute prefixes. This matches the CWE-22 pattern of improper limitation of a pathname to a restricted directory.
Attack Vector
An attacker with access to the MCP tool interface invokes the Media Upload tool with a crafted filePath value pointing to a sensitive file on the host. The server reads and returns that file's contents. Because the vulnerability lives in an MCP tool, indirect prompt injection against an AI agent connected to this server can also trigger the read without direct attacker access. Additional technical detail is available in the GitHub Issue #5 Discussion and the VulDB CVE-2026-81485 entry.
No verified proof-of-concept code is published in the enriched data set. See the GitHub LinkedIn Ads Repository for source review.
Detection Methods for CVE-2026-81485
Indicators of Compromise
- Invocations of the Media Upload MCP tool where filePath contains ../, ..\, or absolute paths outside the configured media directory.
- MCP server logs showing fs.readFileSync reads of files such as /etc/passwd, /proc/self/environ, SSH keys, or application configuration files.
- Outbound MCP responses containing file contents that do not match expected media MIME types.
Detection Strategies
- Instrument the campaign-management.ts tool handler to log every filePath argument and flag paths that resolve outside the media root.
- Add static analysis rules that identify fs.readFileSync usage on untrusted input across MCP tool implementations.
- Correlate MCP tool invocations with agent prompts to identify indirect prompt injection patterns targeting file access.
Monitoring Recommendations
- Monitor process file access telemetry from the host running the MCP server for reads outside the expected media directory.
- Alert on anomalous file-read volume or reads of high-sensitivity paths by the Node.js process hosting linkedin-ads-mcp.
- Forward MCP server access and error logs to a centralized log store for retention and query.
How to Mitigate CVE-2026-81485
Immediate Actions Required
- Stop exposing linkedin-ads-mcp 1.0.0 to untrusted callers or untrusted AI agents until a fix is available.
- Run the MCP server under a low-privilege account that cannot read sensitive host files.
- Restrict the process using OS-level sandboxing such as containers, chroot, or systemd ReadOnlyPaths and ProtectHome.
- Review MCP server logs for prior invocations of the Media Upload tool with suspicious filePath values.
Patch Information
No vendor patch is available at the time of publication. According to the disclosure, the project was informed through an issue report but has not responded. Track the GitHub Issue #5 Discussion and the GitHub LinkedIn Ads Repository for a fix. A correct remediation must canonicalize the input with path.resolve and verify the resolved path is a descendant of an allowlisted media directory before calling fs.readFileSync.
Workarounds
- Fork the project and add a path validation wrapper that rejects any filePath containing .. or resolving outside the media root.
- Place the MCP server behind an authenticating proxy that filters tool arguments and blocks path traversal patterns.
- Mount only the intended media directory into the process namespace so traversal cannot reach sensitive files.
- Disable or remove the Media Upload tool registration from the MCP server if the functionality is not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
