CVE-2026-65695

The vulnerability is a path traversal in an MCP server's document tool: the check_filename_string function validates that a filename contains only allowed characters, but never resolves the path with realpath, allowing sequences like ../etc/passwd to succeed. The fix is trivial — add realpath() and compare against an allowed base directory — but the deeper issue is what makes this CVE worth your attention. This lives inside an MCP server, meaning the entry point isn't a human user directly invoking file operations. It's an AI agent passing a filename it derived from somewhere — potentially from document content, a user's prompt, or a poisoned context window from prompt injection elsewhere. The traditional path traversal mitigation assumes a human attacker who must get past validation; here, the attacker model collapses because the LLM-as-caller eliminates the human-in-the-loop that those mitigations were designed for. This reframes severity significantly. A CVSS 6.8 measures direct API exploitation, but the emergent risk in agentic workflows is that any component capable of influencing what the calling LLM passes as a filename gains arbitrary filesystem access through the MCP server. The vulnerability becomes an amplifier for prompt injection — not a standalone attack requiring direct API access. What you should do: verify whether any MCP document tools in your agentic workflows accept filename arguments without realpath canonicalization. If they do, the fix is straightforward, but recognize that patching the path traversal doesn't solve the underlying provenance problem — the tool still has no way to distinguish a filename derived from legitimate user intent versus one injected via poisoned context. Consider what confinement model your MCP document tools should implement in agentic contexts, and whether strict path-gathering semantics (requiring tools to canonicalize against explicit working-directory constraints) belong in your security baseline.

Reviewed through automated stages and approved by a human before publication.