Executive brief
Office-Word-MCP-Server is a tool used to allow AI models and other applications to interact with Microsoft Word documents. A security flaw allows an attacker to manipulate file paths to read, create, or overwrite Word documents anywhere on the system that the application has access to. This could lead to the theft of sensitive corporate documents or the unauthorized modification of important files outside of the application's intended storage area.
Technical details
A path traversal vulnerability exists in Office-Word-MCP-Server through version 1.1.11 due to insufficient validation of the 'filename' argument in its document tools. The 'check_file_writeable' and 'ensure_docx_extension' helper functions fail to perform base-directory confinement or realpath validation, allowing the use of absolute paths and '../' sequences. An attacker who can influence the filename argument (e.g., via prompt injection in an LLM context) can read any .docx file accessible to the process or overwrite existing documents. The vulnerability is confirmed in 'get_document_text' and 'create_document' operations within 'word_document_server/tools/document_tools.py'.
Affected products
- GongRzhe Office-Word-MCP-Server through 1.1.11
Timeline
- 2026-03-03: other: Project archived by owner
- 2026-07-23: disclosed: Vulnerability disclosed by VulnCheck and George Chen
- 2026-07-23: advisory