CVE-2026-94037: mcp-file-analyzer Path Traversal Flaw

CVE-2026-94037 Overview

CVE-2026-94037 is a path traversal vulnerability [CWE-22] in the 00Kisumi00 mcp-file-analyzer project, an open-source Model Context Protocol (MCP) tool for file analysis. The flaw resides in the ControlFlowNode function within main.py, part of the analyze_csv_data MCP tool. An attacker with low-level privileges can manipulate the filename argument to traverse directories and access files outside the intended scope. The project uses a rolling release model, so no fixed version identifiers are provided. The affected commit is 84740852f0cf0cf5db4781b1ca6d7c6a6d210405.

Critical Impact
Remote attackers can read arbitrary files accessible to the MCP tool by supplying crafted filename values, exposing sensitive data on the host running the analyzer.

Affected Products

00Kisumi00 mcp-file-analyzer (rolling release)
Commit 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 and prior
analyze_csv_data MCP tool component

Discovery Timeline

2026-09-20 - CVE-2026-94037 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94037

Vulnerability Analysis

The analyze_csv_data MCP tool exposes a function that accepts a filename argument from the caller. The ControlFlowNode function in main.py uses this input to locate and read a CSV file without normalizing or validating the supplied path. As a result, sequences such as ../ allow the caller to escape the intended working directory. Because MCP tools are commonly invoked by AI agents on behalf of users, the flaw can be reached through any client that speaks to the affected server. According to VulDB, an exploit is publicly available. The project maintainer has been notified through an issue report but has not responded.

Root Cause

The root cause is missing input sanitization on the filename parameter. The code trusts caller-supplied path data and passes it to file-open routines without canonicalization or a base-directory check. Any traversal sequences are resolved by the operating system, allowing access to files outside the tool's data directory.

Attack Vector

Exploitation occurs over the network by invoking the analyze_csv_data MCP tool with a filename value such as ../../etc/passwd or a path to application secrets. The attacker requires low privileges to reach the MCP endpoint. No user interaction is needed. Because the response typically contains parsed file contents, the attacker obtains the target file's data directly. See the GitHub issue tracker and VulDB entry for CVE-2026-94037 for further technical context.

Detection Methods for CVE-2026-94037

Indicators of Compromise

MCP tool invocations where the filename argument contains ../, ..\, absolute paths, or URL-encoded traversal sequences such as %2e%2e%2f.
Access log entries showing the analyze_csv_data tool reading files outside its expected data directory.
Unexpected reads of sensitive system files such as /etc/passwd, SSH keys, or application configuration by the process hosting the MCP server.

Detection Strategies

Instrument the MCP server to log every filename value passed to analyze_csv_data and alert on traversal patterns.
Correlate file-open syscalls from the MCP process against an allowlist of the intended data directory.
Review AI agent conversation logs for prompts that induce path traversal in tool arguments.

Monitoring Recommendations

Enable file integrity and access monitoring on directories containing credentials, keys, and configuration files.
Track outbound data volumes from hosts running MCP tools to identify bulk file exfiltration.
Alert on process-level access to sensitive paths by any Python interpreter running main.py from the mcp-file-analyzer project.

How to Mitigate CVE-2026-94037

Immediate Actions Required

Restrict network exposure of the mcp-file-analyzer service to trusted clients only, ideally behind authentication and network segmentation.
Run the MCP tool under a dedicated, low-privilege user account with filesystem access limited to the intended data directory.
Apply a local patch that canonicalizes the filename argument and rejects paths outside the CSV data directory.

Patch Information

At the time of publication, the maintainer of 00Kisumi00/mcp-file-analyzer has not released a fix. The project follows a rolling release model, so no fixed version identifier exists. Monitor the project repository and issue #1 for maintainer response and downstream forks that address the traversal.

Workarounds

Wrap the tool with an input filter that resolves the supplied path with os.path.realpath and verifies it starts with the approved base directory.
Reject any filename containing .., backslashes, or absolute path prefixes before invoking ControlFlowNode.
Deploy the MCP server inside a container or chroot with only the intended CSV files mounted read-only.

bash

# Configuration example - path validation wrapper (illustrative)
BASE_DIR="/opt/mcp-file-analyzer/data"
RESOLVED=$(realpath -m "$BASE_DIR/$USER_INPUT")
case "$RESOLVED" in
  "$BASE_DIR"/*) exec python main.py --file "$RESOLVED" ;;
  *) echo "rejected: path traversal attempt" >&2; exit 1 ;;
esac