Executive brief
Firecrawl MCP Server is a tool that adds web scraping capabilities to LLM clients like Claude. A vulnerability in its firecrawl_parse component allows attackers to read arbitrary files from the system by supplying crafted file paths, potentially exposing sensitive configuration, credentials, and environment variables that are then returned to the AI model.
Technical details
The firecrawl_parse tool in version 3.20.2 accepts filePath arguments without proper directory containment validation. Attackers can supply absolute paths or directory traversal sequences (e.g., ../) to bypass intended access restrictions and read files outside intended directories. The vulnerability requires network access to the MCP server and the ability to invoke the firecrawl_parse tool. Successful exploitation allows reading sensitive files such as credentials, environment variables, and other confidential data, which are then returned and incorporated into the model context. Patches are available in newer versions.
Affected products
- Firecrawl MCP Server 3.20.2
Timeline
- 2026-09-04: disclosed