CVE-2026-65695
Received Received - Intake

Path Traversal in Office-Word-MCP-Server

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the check_file_writeable and ensure_docx_extension helpers which perform no base-directory confinement or realpath validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65695
EUVD
EUVD-2026-48308

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in Office-Word-MCP-Server through version 1.1.11. It allows attackers to manipulate the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. The issue occurs because the document open and save operations do not properly validate paths, enabling the use of absolute paths or directory traversal sequences like ../ to bypass security checks.

Detection Guidance

To detect this vulnerability, monitor for unusual file access patterns or unauthorized .docx file operations in your system logs. Check for processes running Office-Word-MCP-Server version 1.1.11 or earlier and inspect network traffic for suspicious filename parameters containing absolute paths or directory traversal sequences like ../.

Impact Analysis

Attackers could exploit this to access sensitive .docx files on your system, even if they are outside the intended directory. They could also overwrite existing files or create new malicious .docx files anywhere the server process has write permissions. This could lead to data theft, file corruption, or unauthorized content injection.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive documents, violating data protection requirements under GDPR and HIPAA. GDPR mandates strict controls over personal data access, while HIPAA requires protection of health information. Exploitation could result in non-compliance, legal penalties, and reputational damage due to data breaches.

Mitigation Strategies

Immediately upgrade to the latest version of Office-Word-MCP-Server if available. If not, restrict access to the server, enforce strict path validation in file operations, and ensure all filename parameters are sanitized to prevent absolute paths or directory traversal sequences. Consider disabling the service until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart