CyberRota Analysis
AI-GeneratedThe firecrawl-mcp-server version 3.20.2 is vulnerable due to an arbitrary local file read flaw in the firecrawl_parse tool, which allows attackers to exploit unconstrained filePath arguments. This vulnerability can lead to the exposure of sensitive files, such as credentials and environment variables, posing a significant risk to data confidentiality. Organizations using this version of the software should prioritize remediation to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.