Home / Vulnerability Intelligence / CVE-2026-40576

CVE-2026-40576 - Vulnerability Analysis

CriticalCVSS: 9.4

Last Updated: April 21, 2026

excel-mcp-server - Path Traversal

Published: April 21, 2026Updated: April 21, 2026Remote Exploitable

Overview

excel-mcp-server <= 0.1.7 contains a path traversal caused by improper validation of file paths in get_excel_path() function, letting unauthenticated remote attackers read, write, and overwrite arbitrary files, exploit requires network access with default configuration.

Severity & Score

Severity: Critical

CVSS Score: 9.4

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Unauthenticated remote attackers can read, write, and overwrite arbitrary files on the host, leading to full system compromise.

Mitigation

Update to version 0.1.8 or later.

References

https://github.com/haris-musa/excel-mcp-server/security/advisories/GHSA-j98m-w3xp-9f56

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Apr 21, 2026

🔴 CVE-2026-40576 - Critical (9.4) excel-mcp-server is a Model Context Protocol server for Excel file manipulation. A path traversal vulnerability exists in excel-mcp-server versions up to and including 0.1.7. When running in SSE or Streamable-HTTP transport mode (the documented wa... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40576/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Apr 21, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-40576
Severity: Critical
CVSS Score: 9.4
Type: path_traversal
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-22

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days