CVE-2026-85606: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in firecrawl firecrawl-mcp-server

The firecrawl-mcp-server 3.20.2 and earlier versions up to 3.24.0 contain a path traversal vulnerability in the firecrawl_parse tool. This tool accepts filePath arguments without validating that the path is contained within a restricted directory. As a result, attackers can provide absolute paths or directory traversal sequences to read arbitrary local files. Sensitive information like credentials and environment variables can be accessed and subsequently uploaded and returned to the model context, potentially exposing confidential data.

An attacker with network access can exploit this vulnerability without authentication to read arbitrary local files on the server. This can lead to disclosure of sensitive information such as credentials and environment variables, which may compromise the confidentiality of the system and any dependent services or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the firecrawl-mcp-server and monitor for suspicious usage of the firecrawl_parse tool with unusual filePath arguments.