A critical path-confinement flaw in excel-mcp-server 0.1.8 lets attackers read and write any file the server process can reach, scoring 9.8 on CVSS v3.1.
What Is It
CVE-2026-85661 is a path traversal vulnerability (CWE-22) in excel-mcp-server, an open-source Model Context Protocol server for Excel file manipulation maintained by haris-musa. In stdio mode, when the EXCEL_FILES_PATH environment variable is unset, the server fails to enforce path confinement. Attackers can supply unchecked file paths to the read and write tools and access any file accessible to the process.
VulnCheck ([email protected]) is the disclosing source. The CVE was published 2026-09-04 and currently carries NVD status "Received."
Why It Matters
The CVSS v3.1 base score is 9.8 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 score of 9.3 (CRITICAL) was also assigned. There is no authentication requirement, no user interaction, and low attack complexity, with high impact across confidentiality, integrity, and availability.
Arbitrary write access is the sharper edge here: an attacker who can steer the MCP server's file paths can both exfiltrate sensitive data and modify files under the process's privileges. Because MCP servers frequently run alongside AI agent tooling with access to developer workstations or service accounts, the effective blast radius is whatever that process account can touch.
There is no CISA KEV entry for this CVE, and no evidence of active exploitation was supplied. CVSS v4.0 exploit maturity is Not Defined.
What's Vulnerable
- Vendor: haris-musa
- Product: excel-mcp-server (
pkg:pypi/excel-mcp-server) - Affected versions: 0 through 0.1.8 (inclusive); all other versions default to unaffected
- Condition: stdio mode with
EXCEL_FILES_PATHunset
No CPE entries were listed in the NVD record.
Patch Status
The supplied source material does not name a fixed version or list a patch reference. No CISA KEV required action or remediation deadline applies, since the CVE is not in the KEV catalog. The upstream GitHub issue (#149) and the VulnCheck advisory are the authoritative places to track a fix. Operators running 0.1.8 or earlier in stdio mode should treat setting EXCEL_FILES_PATH as the documented condition that gates the flaw.