Executive brief
The linkedin-ads-mcp server is a tool that integrates LinkedIn Ads management with AI assistants, allowing campaign creation and media uploads. A path traversal vulnerability in the upload_image function allows an attacker to read arbitrary files from the server's filesystem by manipulating the file path argument, potentially exposing sensitive data or credentials stored on the server.
Technical details
The vulnerability is a path traversal (CWE-22) in the upload_image MCP tool, located in src/tools/campaign-management.ts and src/lib/linkedin-api.ts. The filePath parameter accepts user-controlled input without validation, canonicalization, or enforcement of directory boundaries. An attacker who can invoke the MCP endpoint can pass absolute paths or traversal sequences (e.g., "C:\\tmp\\outside-workspace-secret.txt") to fs.readFileSync(), causing the server to read arbitrary files accessible to the process. The vulnerability requires network access to the MCP interface but no authentication or user interaction. An attacker can exfiltrate file contents through the upload mechanism. No patch was available at the time of report.
Affected products
- danielpopamd linkedin-ads-mcp 1.0.0
Timeline
- 2026-08-27: disclosed: CVE-2026-81485 published on NVD
- 2026-07-12: other: Vulnerability reported via GitHub issue #5
- 2026-07-08: other: Initial report date