A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. (CVE-2026-81485)

The vulnerability in danielpopamd linkedin-ads-mcp 1.0.0 involves improper validation of the filePath argument passed to the fs.readFileSync function in the Media Upload component (src/tools/campaign-management.ts). This leads to a path traversal (CWE-22) vulnerability, allowing remote attackers to read arbitrary files on the system. The vulnerability is publicly disclosed, but no patch or official fix has been released by the project. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.

An attacker can remotely exploit this vulnerability to perform path traversal attacks, potentially reading sensitive files on the affected system. The impact is limited to confidentiality as there is no integrity or availability impact reported. No known active exploitation in the wild has been documented.

No official patch or fix is currently available, and the project has not responded to the vulnerability report. Users should monitor the project for updates or advisories. Until a fix is released, avoid exposing the vulnerable component to untrusted networks or inputs that could be manipulated to exploit the path traversal.