# CVE-2025-5273: Markdownify MCP Server arbitrary file read in get-markdown-file tool

Source: https://junglewise.ai/threats/cve-2025-5273-markdownify-mcp-server-arbitrary-file-read-in-get-markdown-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-29. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2025-5273 · Severity: low · CVSS 3.1 · Published 2025-05-29

Markdownify MCP Server is a tool used to convert various file formats and web content into Markdown text for use with AI models. A security flaw allows an attacker to trick the server into reading sensitive files from the host computer, such as system configuration or password files. This could lead to the exposure of private data if an AI agent or user interacts with a malicious prompt or website.

Technologies: [mcp-markdownify-server (npm)](https://junglewise.ai/threats/technologies/mcp-markdownify-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-5273 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-5273 being exploited in the wild.

**How severe is CVE-2025-5273?** Low severity, with a CVSS score of 3.1, published 29 May 2025.

**Which products and versions are affected?** mcp-markdownify-server (npm) SEMVER:introduced=0,last_affected=0.0.1.

**Is there a fix for CVE-2025-5273?** A patch was published on 2025-05-29: Fix committed in version 1.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-5273 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-5273?** Check whether you run mcp-markdownify-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The mcp-markdownify-server package is vulnerable to an arbitrary file read vulnerability (CWE-552) within its 'get-markdown-file' tool. The root cause is a lack of path validation or extension filtering in the 'get' method of the Markdownify class, which directly reads a file from a provided 'filePath' argument. An attacker can exploit this by crafting a malicious prompt or web page that, when processed by an MCP-enabled AI host, triggers the tool to access sensitive system files (e.g., /etc/passwd). While the attack is delivered over the network, it requires user interaction (the user or their AI agent must access the malicious content). The vulnerability is fixed in version 1.0.0 by implementing file extension validation.

## Affected products

- zcaceres mcp-markdownify-server < 1.0.0

## Identifiers

- CVE-2025-5273
- GHSA-22v8-p7h2-rj7p

## Timeline

- 2025-05-28: disclosed: Vulnerability disclosed by Snyk research team.
- 2025-05-29: advisory: GitHub Advisory GHSA-22v8-p7h2-rj7p published.
- 2025-05-29: patched: Fix committed in version 1.0.0.

## References

- [https://github.com/zcaceres/markdownify-mcp/commit/3a6b202d088ef7acb8be84bc09515f41a2b1a9df](https://github.com/zcaceres/markdownify-mcp/commit/3a6b202d088ef7acb8be84bc09515f41a2b1a9df)
- [https://github.com/zcaceres/markdownify-mcp](https://github.com/zcaceres/markdownify-mcp)
- [https://github.com/zcaceres/markdownify-mcp/blob/3667bd4765c0e49684ce22df268d02dd478a7f3b/src/Markdownify.ts](https://github.com/zcaceres/markdownify-mcp/blob/3667bd4765c0e49684ce22df268d02dd478a7f3b/src/Markdownify.ts)
- [https://security.snyk.io/vuln/SNYK-JS-MCPMARKDOWNIFYSERVER-10249193](https://security.snyk.io/vuln/SNYK-JS-MCPMARKDOWNIFYSERVER-10249193)

## Related threats

- [mcp-markdownify-server command injection in pptx-to-markdown](https://junglewise.ai/threats/cve-2025-58358-mcp-markdownify-server-command-injection-in-pptx-to-markdown)
- [Markdownify MCP Server Server-Side Request Forgery in webpage and search tools](https://junglewise.ai/threats/cve-2025-5276-markdownify-mcp-server-server-side-request-forgery-in-webpage-and)