PT-2026-45499 · Ishayoyo · Excel-Mcp

Ccccccctfi · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-10278

NVD

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

A vulnerability was determined in ishayoyo excel-mcp up to 1.0.2. Impacted is an unknown function of the file src/index.ts of the component read file/write file. Executing a manipulation of the argument filePath/outputPath can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-10278

Affected Products

Excel-Mcp

References · 7

• 🔥 https://github.com/ishayoyo/excel-mcp/issues/6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10278 · Security Note
• https://vuldb.com/cve/CVE-2026-10278 · Note
• https://vuldb.com/vuln/367571 · Note
• https://vuldb.com/submit/825418 · Note
• https://github.com/ishayoyo/excel-mcp · Note
• https://vuldb.com/vuln/367571/cti · Note