CVE-2026-79622
Received Received - Intake

Path Traversal in dekdee Adobe XD MCP

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulDB

Description
A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79622
EUVD
EUVD-2026-65490

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dekdee adobe-xd-mcp 1.0.0
dekdee adobe_xd_mcp 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the dekdee adobe-xd-mcp 1.0.0 project. It occurs because the MCP tools accept user-controlled arguments like outputFile and outputDir without proper validation. An attacker can manipulate these arguments to read arbitrary local files or write files to attacker-selected locations outside the intended workspace.

Detection Guidance

Check if the adobe-xd-mcp server is running and exposed to untrusted networks. Inspect logs for suspicious file operations or path manipulation attempts in the outputFile/outputDir arguments. Look for tools like get_xd_info, generate_react_component, or extract_colors being invoked with absolute paths or traversal sequences.

Impact Analysis

An attacker could exploit this to read sensitive local files, overwrite or create files outside the intended workspace, or disrupt system availability by overwriting critical files. The impact includes high confidentiality and integrity risks, depending on the files accessed or modified.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to unauthorized data exposure or modification.

Mitigation Strategies

Restrict access to the MCP server to trusted users only. Validate and sanitize all file path arguments to prevent traversal and absolute path usage. Update to a patched version if available. Consider disabling vulnerable tools or implementing strict workspace boundaries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79622. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart