CVE-2026-81485: Path Traversal in danielpopamd linkedin-ads-mcp

The vulnerability in danielpopamd linkedin-ads-mcp 1.0.0 involves improper validation of the filePath argument passed to the fs.readFileSync function in the Media Upload component (src/tools/campaign-management.ts). This improper validation enables path traversal attacks, allowing remote attackers to read arbitrary files on the system. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and partial confidentiality impact. The project was notified early but has not issued a fix or response. Public exploit information is available, but no known active exploitation in the wild has been reported.

Successful exploitation allows remote attackers to read arbitrary files on the affected system by manipulating the filePath parameter, potentially exposing sensitive information. There is no indication of privilege escalation, integrity, or availability impacts. The vulnerability affects confidentiality partially.

No official fix or patch is currently available for this vulnerability. Since the project has not responded or released a remediation, users should consider restricting access to the vulnerable component or implementing input validation controls to prevent path traversal. Monitor the vendor or project repository for any future updates or patches addressing this issue.