CVE-2026-43901

Katalog CVE

CVSS 6.8 · Medium EPSS 0,36%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada bx33661 wireshark mcp. Skor CVSS 3.1 6.8 (Medium) menurut github.com.

Deskripsi (NVD)

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox (_allowed_dirs) is None by default and only activates when the environment variable WIRESHARK_MCP_ALLOWED_DIRS is explicitly set. In a default installation, any directory on the filesystem can be used as the export destination.

Rincian

Terbit di NVD

11 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bx33661/Wireshark-MCP/security/advisories/GHSA-3r68-x3xc-rxpg exploit · mitigasi · patch · advisory vendor