CVE-2026-40576: 
Python vulnerability analysis and mitigation

CVE-2026-40576 is a path traversal vulnerability (CWE-22) in excel-mcp-server, a Model Context Protocol (MCP) server for Excel file manipulation. It affects all versions up to and including 0.1.7, and was disclosed via a GitHub Security Advisory on April 12, 2026, with NVD publication on April 21, 2026. The flaw allows unauthenticated network attackers to read, write, and overwrite arbitrary files on the host filesystem. It carries a CVSS v3.1 base score of 9.4 (Critical) per Feedly, or 8.2 (High) per the GitHub advisory (GitHub Advisory).

The root cause lies in the get_excel_path() function in src/excel_mcp/server.py (lines 75–94), which contains two independent flaws classified as CWE-22. Flaw 1: If the supplied filename is an absolute path (e.g., /etc/shadow), the function returns it unchanged without consulting the EXCEL_FILES_PATH sandbox directory. Flaw 2: Relative paths are joined using os.path.join(EXCEL_FILES_PATH, filename) without calling os.path.realpath() or os.path.commonpath(), meaning ../ sequences silently escape the sandbox. Compounding these flaws, the server binds to 0.0.0.0 by default (all interfaces) and ships with zero authentication on its SSE and Streamable-HTTP transports, exposing all 25 MCP tool handlers to any TCP client reaching port 8017. A proof-of-concept exploit script was developed by the reporter (hits313) and shared privately with the maintainer, with an asciinema recording publicly available (GitHub Advisory).

An unauthenticated remote attacker can read any file on the host filesystem (e.g., exfiltrating HR records, financial spreadsheets, or credential files), write or overwrite arbitrary files (enabling silent data corruption of audit reports or salary sheets), create arbitrary directory trees (a precursor to privilege escalation), and fill disk space to cause denial of service. Additionally, an attacker could plant macro-enabled Excel templates (.xltm) at known shared paths to establish a client-side RCE chain when downstream users open the file. The project has over 3,600 GitHub stars and active PyPI downloads, meaning the affected population is significant (GitHub Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). However, the vulnerability is trivially exploitable given zero authentication requirements, a default bind address of 0.0.0.0, and the simplicity of the path traversal technique. The EPSS score is 0.052% (0.000520), indicating currently low predicted exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The reporter (hits313) confirmed all 7 exploitation primitives passed against a live server instance (GitHub Advisory).

1. Reconnaissance: Identify hosts running excel-mcp-server in SSE or Streamable-HTTP mode using network scanners (e.g., Shodan, Nmap) targeting port 8017 (default). Confirm the server is version ≤0.1.7.
2. Establish unauthenticated connection: Connect to the server's MCP endpoint (e.g., http://<target>:8017) with no credentials — the server accepts any TCP client with zero authentication.
3. Enumerate tools: List the 25 exposed MCP tool handlers to identify read/write primitives such as read_data_from_excel, create_workbook, and write_data_to_excel.
4. Exploit Flaw 1 (absolute path bypass): Call a read tool with filepath="/etc/passwd" or filepath="/home/user/secrets.xlsx". The get_excel_path() function returns the path unchanged, granting direct filesystem access outside the sandbox.
5. Exploit Flaw 2 (relative traversal): Call a write tool with filepath="../../tmp/cve-hunt/outside_sandbox/malicious.xlsx". The os.path.join() call produces a path that resolves outside EXCEL_FILES_PATH without validation.
6. Achieve objectives: Read sensitive files (exfiltrate data), overwrite business-critical files with attacker-controlled content, create arbitrary directory trees, or plant macro-enabled templates at shared paths for downstream RCE (GitHub Advisory).

• Network: Unexpected inbound TCP connections to port 8017 from external or untrusted IP addresses; MCP tool invocations originating from non-local clients.
• File System: Excel files (.xlsx, .xltm) appearing outside the configured EXCEL_FILES_PATH directory; unexpected directory trees created at arbitrary writable locations (e.g., /tmp/attacker_dir/deep/nested/); modification timestamps on sensitive files updated unexpectedly.
• Logs: Server access logs showing MCP tool calls with filepath arguments containing absolute paths (e.g., /etc/, /home/, /root/) or ../ sequences; error messages referencing file format issues on non-Excel files (e.g., /etc/hostname) indicating attempted access.
• Process: The excel-mcp-server process opening files outside its designated sandbox directory as observed via lsof or auditd file access events (GitHub Advisory).

Upgrade excel-mcp-server to version 0.1.8, which fixes the get_excel_path() function by rejecting absolute paths in remote mode, stripping NUL bytes, and using os.path.realpath() with os.path.commonpath() validation to enforce the EXCEL_FILES_PATH sandbox boundary. As immediate workarounds: set FASTMCP_HOST=127.0.0.1 to restrict the bind address to localhost only; implement network-level firewall rules to block external access to port 8017; and avoid exposing the server on untrusted networks until patched. Organizations should also consider adding a reverse proxy with authentication in front of the MCP server for any remote deployment (GitHub Advisory).

The vulnerability was covered in a dev.to post by the MCPwn project, which scanned the supply chains of 14 MCP servers and highlighted CVE-2026-40576 as part of a broader pattern of path traversal vulnerabilities in MCP server implementations (MCPwn Analysis). A technical blog post on AgentLair.dev discussed the MCP path traversal pattern in the context of this CVE (AgentLair Blog). The Hacker Wire also noted the vulnerability on Mastodon, reflecting broader community awareness of MCP server security risks.