CVE-2026-85606
Received Received - Intake

Arbitrary Local File Read in Firecrawl MCP Server

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85606
EUVD
EUVD-2026-71222

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
firecrawl firecrawl_mcp_server to 3.24.0 (inc)
firecrawl firecrawl_mcp_server 3.24.1
firecrawl firecrawl_mcp_server 3.20.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85606 is an arbitrary local file read vulnerability in firecrawl-mcp-server version 3.20.2. The firecrawl_parse tool accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables.

Detection Guidance

Check if firecrawl-mcp-server version 3.20.2 or earlier is installed. Look for the firecrawl_parse tool in use. Test by attempting to read sensitive files using crafted filePath arguments like absolute paths or directory traversal sequences (e.g., ../etc/passwd).

Commands to check version: npm list firecrawl-mcp-server or grep version in package.json. Monitor network traffic for unexpected file uploads to external APIs.

Impact Analysis

This vulnerability allows attackers to read arbitrary local files on the system running firecrawl-mcp-server. Sensitive files such as credentials, environment variables, or configuration files could be exposed. The attacker can then access this data through the model context, potentially leading to data breaches or unauthorized access.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach via this vulnerability may result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade firecrawl-mcp-server to version 3.24.1 or later immediately. Implement path confinement for the firecrawl_parse tool to restrict file access to a specific base directory. Validate all filePath inputs against an allowlist of permitted files or directories.

Disable the firecrawl_parse tool if not essential. Review and rotate any exposed credentials or sensitive data that may have been accessed. Monitor for unusual activity or unauthorized file reads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart