CVE-2026-79622

dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal

View on CVE.org
Published Aug 25, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The vulnerability in dekdee's adobe-xd-mcp allows an attacker to manipulate the outputFile/outputDir parameters within the file-access-from-request endpoint to perform a path traversal attack, potentially enabling the reading or writing of arbitrary files on the host system.

Affected Systems

dekdee:adobe-xd-mcp version 1.0.0 is affected. No other versions are listed as vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but publicly disclosed exploits exist, meaning the risk is tangible and attackers can launch the attack remotely via the exposed endpoint.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for a newer version of adobe-xd-mcp that contains a fix and upgrade if available.
  • If no patch is available, restrict the file-access-from-request endpoint to a whitelisted directory and reject any outputFile or outputDir values containing ../ or absolute paths.
  • Implement strict input validation or sanitization on the outputFile/outputDir parameters to eliminate traversal characters.
  • Monitor HTTP logs for requests targeting the vulnerable endpoint and for attempts to use directory traversal patterns.

Generated by OpenCVE AI on August 25, 2026 at 14:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal
First Time appeared Dekdee
Dekdee adobe-xd-mcp
Weaknesses CWE-22
CPEs cpe:2.3:a:dekdee:adobe-xd-mcp:*:*:*:*:*:*:*:*
Vendors & Products Dekdee
Dekdee adobe-xd-mcp
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 25, 2026, 2:33 PM
Reserved
Aug 25, 2026, 8:40 AM

View source JSON

Updated
Aug 25, 2026, 2:32 PM

JSON

Status
Deferred
Published
Aug 25, 2026, 2:16 PM
Modified
Aug 26, 2026, 4:19 PM

View source JSON

No data.

Updated
Aug 28, 2026, 8:37 PM

JSON