excel-mcp-server Path Confinement Bypass (Arbitrary File Read/Write)

Technical Analysis

The vulnerability stems from missing path confinement logic in excel-mcp-server 0.1.8 when the EXCEL_FILES_PATH environment variable is unset in stdio transport mode; the server's read/write tool handlers accept file paths without validating them against an allowed base directory, permitting directory traversal-style access (e.g., '../../etc/passwd' or absolute paths) to any file the process user can access. With a CVSS score of 9.8, this is rated critical because it enables both confidentiality and integrity compromise with no required privileges beyond invoking the exposed MCP tool. Since this MCP server is designed to be invoked by LLM-driven AI agents through function/tool-calling interfaces, a prompt-injected or manipulated agent request could be leveraged to read sensitive files (credentials, API keys, SSH keys) or overwrite critical files on the host running the agent stack. This directly impacts AI agent systems: any organization running excel-mcp-server as a tool endpoint for LLM agents risks credential theft, RAG data poisoning, or full host compromise via prompt injection or malicious tool-call arguments that traverse outside intended file boundaries.

Affected Systems

excel-mcp-server version 0.1.8 running in stdio transport mode with EXCEL_FILES_PATH environment variable unset; deployments integrating this MCP server into AI agent/LLM tool-calling pipelines (e.g., Claude Desktop, custom MCP clients, agent frameworks using MCP tool registries)

Indicators of Compromise

• Package name: excel-mcp-server (version 0.1.8)
• Environment indicator: EXCEL_FILES_PATH unset in stdio mode
• Suspicious tool-call arguments containing path traversal sequences (../, absolute paths, /etc/, C:\Windows\, ~/.ssh/)
• Unexpected file reads/writes outside configured Excel working directory in MCP server logs

Remediation Steps

1. 1

   Upgrade excel-mcp-server

   Update to a patched version of excel-mcp-server that enforces path confinement regardless of EXCEL_FILES_PATH configuration state.

2. 2

   Set EXCEL_FILES_PATH explicitly

   Always configure EXCEL_FILES_PATH to a restricted, dedicated directory and verify the server rejects paths outside this boundary before deploying in stdio mode.

3. 3

   Sandbox MCP tool execution

   Run MCP servers with least-privilege process permissions, filesystem namespacing, or containerization to limit blast radius if path confinement is bypassed.

4. 4

   Audit agent tool-call inputs

   Implement input validation/allowlisting on file path arguments passed from LLM agents to MCP tools, and log/alert on anomalous path patterns.

5. 5

   Rotate exposed credentials

   If the server has been running unpatched, rotate any API keys, tokens, or secrets stored on the host that could have been read via arbitrary file access.

6. 6

   Review MCP server inventory

   Audit all MCP servers integrated into agent pipelines for similar unvalidated path handling vulnerabilities before granting file-system tool access.