Threat database

CVE-2026-81485 is a path traversal vulnerability in danielpopamd linkedin-ads-mcp version 1.0.0. The flaw exists in the fs.readFileSync function within the src/tools/campaign-management.ts file, specifically in the Media Upload component. This vulnerability allows an attacker to manipulate the filePath argument to access unauthorized files. The vulnerability can be exploited remotely. The issue was reported early to the project but no response or fix has been provided yet. Public exploit details have been disclosed.