The vulnerable firecrawl_parse tool in firecrawl-mcp-server 3.20.2 accepts filePath arguments without validating directory containment, allowing attackers to specify absolute paths or directory traversal sequences. This flaw enables reading sensitive local files such as credentials or environment variables, which are then uploaded and returned to the model context. The core weakness is a classic arbitrary file read, mapped to CWE-22.

The affected product is firecrawl:firecrawl-mcp-server. Vulnerable releases include version 3.20.2; the issue is fixed in later releases such as 3.24.1. No additional vendors or products are listed.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is not available, so the likelihood of exploitation is uncertain, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers are likely to exploit this flaw from a position with access to the server’s network, allowing arbitrary file read from the host.