A path traversal vulnerability (CWE-22) exists in excel-mcp-server versions up to and including 0.1.7. The server fails to properly restrict file operations to a configured sandbox directory, allowing unauthenticated remote attackers to read, write, and overwrite arbitrary files on the host filesystem via crafted filepath arguments. This is due to improper handling of absolute paths and relative path traversal sequences. The server binds by default to all network interfaces without authentication, increasing exposure. A fix is available in version 0.1.8.