Description
A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-25
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Path Traversal
Action: Assess
AI Analysis

Impact

The vulnerability in dekdee's adobe-xd-mcp allows an attacker to manipulate the outputFile/outputDir parameters within the file-access-from-request endpoint to perform a path traversal attack, potentially enabling the reading or writing of arbitrary files on the host system.

Affected Systems

dekdee:adobe-xd-mcp version 1.0.0 is affected. No other versions are listed as vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but publicly disclosed exploits exist, meaning the risk is tangible and attackers can launch the attack remotely via the exposed endpoint.

Generated by OpenCVE AI on August 25, 2026 at 14:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for a newer version of adobe-xd-mcp that contains a fix and upgrade if available.
  • If no patch is available, restrict the file-access-from-request endpoint to a whitelisted directory and reject any outputFile or outputDir values containing ../ or absolute paths.
  • Implement strict input validation or sanitization on the outputFile/outputDir parameters to eliminate traversal characters.
  • Monitor HTTP logs for requests targeting the vulnerable endpoint and for attempts to use directory traversal patterns.

Generated by OpenCVE AI on August 25, 2026 at 14:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal
First Time appeared Dekdee
Dekdee adobe-xd-mcp
Weaknesses CWE-22
CPEs cpe:2.3:a:dekdee:adobe-xd-mcp:*:*:*:*:*:*:*:*
Vendors & Products Dekdee
Dekdee adobe-xd-mcp
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dekdee Adobe-xd-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-25T14:33:37.187Z

Reserved: 2026-08-25T08:40:47.724Z

Link: CVE-2026-79622

cve-icon Vulnrichment

Updated: 2026-08-25T14:32:54.435Z

cve-icon NVD

Status : Deferred

Published: 2026-08-25T14:16:57.420

Modified: 2026-08-26T16:19:05.917

Link: CVE-2026-79622

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:37:08Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')