CVE-2026-79622: Path Traversal in dekdee adobe-xd-mcp

This vulnerability allows remote attackers to perform path traversal by manipulating the outputFile or outputDir parameters in the file-access-from-request endpoint of dekdee adobe-xd-mcp 1.0.0. The flaw exists in the src/parsers/xd-parser.ts file. Successful exploitation could allow unauthorized access to files outside the intended directory. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. The vendor has not yet responded or provided a fix. Public exploit code is available, increasing the risk of potential attacks.

An attacker can remotely exploit this vulnerability to traverse directories on the affected system, potentially accessing sensitive files outside the intended scope. This could lead to information disclosure or further system compromise depending on the files accessed. No known active exploitation in the wild has been reported so far.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, restrict access to the vulnerable endpoint if possible and apply network-level controls to limit exposure. Review and harden file access permissions to minimize potential impact.