CVE-2026-85661: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in haris-musa excel-mcp-server

The vulnerability in excel-mcp-server 0.1.8 and earlier arises from failure to enforce pathname restrictions when the EXCEL_FILES_PATH environment variable is not set. This improper limitation of a pathname to a restricted directory (path traversal) enables attackers to provide arbitrary file paths to the server's read and write tools, thereby accessing any file the process can access. The CVSS 4.0 score of 9.3 indicates a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to read and write arbitrary files on the system running excel-mcp-server, potentially leading to data disclosure, data tampering, or denial of service. The attacker can access any file accessible by the server process, which may include sensitive configuration or system files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to ensure the EXCEL_FILES_PATH environment variable is properly set to restrict file access, or to restrict access to the vulnerable service. Monitor vendor channels for an official patch or update.