CVE-2026-65695 is a path traversal vulnerability affecting GongRzhe Office-Word-MCP-Server through version 1.1.11. The vulnerability exists in the document tools component, where attackers able to influence the filename parameter can bypass the check_file_writeable and ensure_docx_extension functions. These functions fail to enforce base-directory confinement or perform realpath validation, allowing attackers to specify absolute paths or '../' sequences to read arbitrary .docx files or create and overwrite files outside the intended working directory.

Exploitation of this vulnerability can lead to unauthorized reading of sensitive .docx files and unauthorized creation or overwriting of .docx files outside the intended directory. This can result in data disclosure or data tampering. The CVSS 4.0 score of 7.6 (high severity) reflects the network attack vector with high impact on confidentiality and integrity, though requiring user interaction and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or vendor advisory has been provided at this time. Until a patch is available, restrict access to the affected software and monitor for suspicious activity related to document file operations. Avoid exposing the service to untrusted users who might supply malicious filename arguments.