Executive brief
@puchunjie/doc-tools-mcp is a Node.js library for managing Word documents through an MCP (Model Context Protocol) interface. An attacker can read or write arbitrary files on the server's filesystem by supplying malicious file paths to the create_document and open_document functions, bypassing intended access controls and potentially exposing sensitive data or corrupting system files.
Technical details
This is a path traversal vulnerability (CWE-22, CWE-73) in the MCP interface of doc-tools-mcp version 1.0.18. The create_document and open_document tools in src/mcp-server.ts accept a user-supplied filePath argument and pass it directly to fs.writeFile or fs.readFile without validating or constraining the path—no absolute-path rejection, no directory boundary checks, and no traversal sequence filtering. An attacker with network access to the MCP server and user-level privileges can invoke these tools with malicious paths (e.g., /tmp/arbitrary.docx or ../../../etc/sensitive) to read or write Word documents anywhere on the filesystem accessible to the server process. No fix was available at the time of public disclosure.
Affected products
- @puchunjie doc-tools-mcp up to 1.0.18
Timeline
- 2026-04-18: disclosed
- 2026-05-04: advisory
- 2026-05-04: other: Published to OSV database