CVE-2026-85606: firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath
firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawlparse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is remotely exploitable with no required privileges or user interaction. An attacker needs to be able to invoke the firecrawl_parse tool and provide a filePath argument.
What data could be exposed?
An attacker can use absolute paths or directory-traversal sequences to read local files, including credentials and environment variables. The retrieved content is uploaded and returned to the model context.
How can I determine whether my deployment is affected?
Deployments running firecrawl-mcp-server version 3.20.2 are affected if the firecrawl_parse tool accepts filePath values without directory-containment validation. Test or review whether absolute paths and traversal sequences can cause files outside an intended directory to be read.