CVE-2026-81485: danielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal
A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of danielpopamd/linkedin-ads-mcp version 1.0.0 that make the Media Upload functionality remotely reachable are exposed. The vulnerability is in the Media Upload component's handling of the filePath argument.
What does an attacker need to exploit it?
An attacker can perform the attack remotely with low complexity and no privileges or user interaction required. Exploitation involves manipulating the filePath argument passed to fs.readFileSync.
What is the likely impact?
The provided severity vector indicates low confidentiality impact, with no integrity or availability impact. Successful exploitation may allow unauthorized reading of files through path traversal.
Is a public exploit available?
Yes. The exploit has been publicly disclosed and may be used.
Is a fix available from the project?
The project was notified through an issue report but had not responded at the time of the report. No patched version or vendor remediation is identified in the provided data.