External risk intelligence

Excel-mcp-server Arbitrary File Read Write via Stdio Mode

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85661

The vulnerability exists in a Model Context Protocol (MCP) server running in stdio mode. Stdio-based MCP servers are designed for local communication between an AI assistant application and a local tool, not for direct exposure to the public internet. This deployment pattern is inherently local and process-bound.

Path Traversal

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in a specific server component that could allow unauthorized access to files. The issue arises when a particular configuration setting is not defined, potentially enabling attackers to read or write to any file that the server process can access. The main concern at this time is confirming if this technology is in use and if it is exposed in a way that could be exploited.

File access risk due to configuration oversight.
Matters if your AI tools use this specific component.
Confirm usage and exposure for relevance.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability if the `EXCEL_FILES_PATH` setting is not configured in the `excel-mcp-server`. This allows them to manipulate file paths, enabling them to read and write to any file that the server process has access to.

No authentication or user interaction needed.
Unchecked file paths in stdio mode.
Arbitrary file read and write access.

Live Threat

Current exploitation, exposure, and threat context

When `EXCEL_FILES_PATH` is not set, this vulnerability could allow an attacker to read and write any file accessible by the `excel-mcp-server` process when it operates in stdio mode. This occurs because the server does not properly confine file paths provided by an attacker.

Arbitrary files accessible to the process.
Unchecked file paths in stdio mode.
Unauthorized file access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the excel-mcp-server, which allows arbitrary file read/write, likely impacts teams managing AI assistant applications or development environments where this server is deployed. The first practical step is to identify all instances of this server, determine their exposure (especially if used in a non-local context or if the `EXCEL_FILES_PATH` is unset), and ascertain the business criticality of affected systems before planning remediation.

Application or platform owners should address this.
Verify `EXCEL_FILES_PATH` configuration.
Restrict access and plan immediate updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the excel-mcp-server software?

The excel-mcp-server is a specialized tool implementing the Model Context Protocol (MCP). It allows AI assistant applications to interact with Excel files. By bridging the gap between large language models and local spreadsheets, it enables automated data reading and writing tasks within development or analysis workflows.

What does CWE-22 mean for CVE-2026-85661?

CWE-22 refers to Improper Limitation of a Pathname to a Restricted Directory, commonly called Path Traversal. In this CVE, the software fails to constrain file operations to a specific folder. Because it does not validate input paths, the server can be tricked into accessing files outside its intended directory, granting unauthorized read and write capabilities.

How can an attacker trigger this vulnerability?

An attacker triggers this by providing malicious file paths to the server when it runs in stdio mode without the EXCEL_FILES_PATH variable set. If that configuration is defined, the server restricts file operations to that path, preventing the bug. The issue only exists when the server is left in its default, unconfined state.

Is this vulnerability a risk for my local AI tools?

According to Halo Surface Signal, this is very unlikely. The server operates in stdio mode, which is designed for local, process-bound communication between an AI assistant and its tools, not for external network exposure. The risk is significantly reduced because the component is intended for local usage rather than being directly accessible from the public internet.

What are the first steps to secure my environment?

First, locate every instance of the server within your systems. Verify whether the EXCEL_FILES_PATH environment variable is configured for these instances. If it is unset, you are vulnerable; prioritize updating the configuration or the software to enforce strict path confinement and limit the file access of the server process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.