CVE-2026-85606highCWE-22

CVE-2026-85606: falha de alta gravidade em firecrawl-mcp-server

firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath

Publicada em 04 set 2026 · Atualizada em 14 set 2026

Seguir esta CVE + Monitorar firecrawl-mcp-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.9%

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

firecrawl · firecrawl-mcp-server

Referências

https://github.com/firecrawl/firecrawl-mcp-server https://github.com/firecrawl/firecrawl-mcp-server/blob/v3.24.1/src/index.ts https://github.com/firecrawl/firecrawl-mcp-server/issues/306 https://www.vulncheck.com/advisories/firecrawl-mcp-server-3.20.2-arbitrary-local-file-read-via-filepath