CVE-2026-43901
Received Received - Intake
Path Traversal in Wireshark MCP Server

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: GitHub, Inc.

Description
Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox (_allowed_dirs) is None by default and only activates when the environment variable WIRESHARK_MCP_ALLOWED_DIRS is explicitly set. In a default installation, any directory on the filesystem can be used as the export destination.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-11
Generated
2026-06-21
AI Q&A
2026-05-12
EPSS Evaluated
2026-06-20
NVD
CVE-2026-43901
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wireshark wireshark_mcp to 1.1.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Wireshark MCP version 1.1.5 and earlier. The wireshark_export_objects tool accepts a destination directory parameter (dest_dir) controlled by an attacker and passes it directly to tshark's --export-objects flag without enforcing any mandatory path restrictions.

By default, there is no path sandboxing because the _allowed_dirs variable is None unless the environment variable WIRESHARK_MCP_ALLOWED_DIRS is explicitly set. This means that in a default installation, an attacker can specify any directory on the filesystem as the export destination.

Impact Analysis

An attacker can exploit this vulnerability to write exported objects to arbitrary directories on the filesystem. Because there is no enforced path restriction by default, this could lead to unauthorized file writes.

The CVSS score indicates a moderate severity (6.8) with high impact on confidentiality and integrity, meaning sensitive data could be exposed or altered. However, availability is not affected.

Mitigation Strategies

To mitigate this vulnerability, you should explicitly set the environment variable WIRESHARK_MCP_ALLOWED_DIRS to restrict the allowed export directories for the wireshark_export_objects MCP tool.

By default, the path sandbox (_allowed_dirs) is None, meaning any directory can be used as the export destination, which is insecure.

Setting WIRESHARK_MCP_ALLOWED_DIRS limits the directories where exported objects can be saved, preventing attackers from writing files to arbitrary locations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart