Arbitrary File Read/Write in adobe-xd-mcp (CWE-22)

Arbitrary File Read and Write Vulnerability in adobe-xd-mcp #3 Vulnerability Overview Vulnerability Type: Arbitrary File Read and Write Vulnerability CNA / Submission Type: Vulnerability Report (CVE ID Request) Reporter Role: Independent Security Researcher Report Date: July 8, 2026 Reporter Name: cocccctt Reporter Email: cocccctt@outlook.com Permission to Share Contact with Vendor: Yes Vendor: dekdee Product: adobe-xd-mcp Repository: https://github.com/dekdee/adobe-xd-mcp Affected Component(s): - src/index.ts - src/parsers/xd-parser.ts - src/tools/xd-tools.ts Vulnerability Type: - CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) - Short Title: Arbitrary file read/write via MCP XD path arguments Affected Versions: - Confirmed Affected: 1.0.0 (commit 7d5c787 confirmed affected) - Suspected Affected Range: Revisions containing the same request-to-sink flows listed below - Fixed Version: Not available at the time of the report Vulnerability Description: - An arbitrary file read and write vulnerability has been identified in . MCP tools accept attacker-controlled , , and parameters and pass them to file system operations without apparent workspace boundary checks. An attacker can invoke the MCP server to cause the process to read arbitrary local XD file paths and write generated output or extracted color data to attacker-chosen file system locations. Manual reproduction was confirmed prior to the submission of this report. Commit is confirmed affected; no fix version was available at the time of the report. Technical Root Cause: - - Source: tool schemas for , , and expose caller-controlled , , and arguments. - Sink: - Source: tool argument - Sink: - Source: tool argument - Sinks: , , and Attack Prerequisites: - The attacker can invoke an MCP endpoint or tool handler that reaches the vulnerable sink. - There are no valid runtime policies restricting or constraining attacker-controlled values before they are used in the sink. - The vulnerable server is running, and file system or network access is reachable to the chosen payload. Proof of Concept / Reproduction Guidance: - This proof of concept provides a concise CVE-style reproduction example for the reported issue. - 1. Reproduction Request - 2. Validation - Start the affected MCP server and submit the request via the exposed MCP interface or . - Confirm that is created outside the expected workspace. - Repeat using with an attacker-chosen to confirm write control over generated files. Security Impact: - Confidentiality: High (local files selected through MCP path arguments may be read by the server process). - Integrity: High (attacker-controlled output paths may overwrite or create files outside the intended workspace). - Availability: Low to High, depending on the files overwritten. - Scope: Unchanged. CVSS v3.1 Suggestion: - Suggested Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Suggested Base Score: 9.4 (Critical) - Adjust PR upward if the vulnerable tools are strictly admin-only and strongly authenticated. Workarounds / Mitigations: - Restrict file path parameters to an explicit workspace or allowed base directory. - Parse and normalize paths before use, then enforce that the final path resides within the allowed root. - Reject absolute paths, traversal sequences, and symbolic links that escape the allowed root, as well as unexpected file extensions. - Add authentication, authorization, logging, and rate limiting to protect sensitive MCP/HTTP handlers. Recommended Fix: - Eliminate the aforementioned request-to-sink data flow. - Add input schema validation at the MCP/HTTP boundary. - Use secure path helpers that enforce sandboxing and symbolic link resolution after normalization. - Add regression tests demonstrating that attacker-controlled values cannot reach vulnerable file system sinks. - Publish a maintainer security advisory after patch release. References: - Repository: https://github.com/dekdee/adobe-xd-mcp - Reviewed Source Files: , , - CWE-22: https://cwe.mitre.org/data/definitions/22.html Credits: - Discoverer: cocccctt - Discovery Method: Static analysis (CodeQL) plus repository source-code audit and manual reproduction Additional Notes for Form Mapping: - Audit Verdict: Likely Exploitable: Attacker-controlled MCP path arguments can reach filesystem read/write sinks. - Dynamic Exploit Replay Status: Manually reproduced by the reporter before report generation. - Maintainer should validate release mapping before coordinated disclosure.

Goal Reached Thanks to every supporter — we hit 100%!

Arbitrary File Read/Write in adobe-xd-mcp (CWE-22)

More from this source