CVE-2026-85606

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read flaw (CWE-22) in its firecrawl_parse tool, which accepts a filePath argument without validating that the path remains within an allowed directory. An attacker who can control that argument — consistent with the advisory's network attack vector requiring no privileges and no user interaction, e.g. via a crafted tool call or prompt injection — can supply an absolute path or directory-traversal sequence and read arbitrary files on the host. The contents of sensitive files such as credentials and environment-variable files are then uploaded and returned into the model context, potentially exposing secrets to the model provider or downstream systems. Anyone running firecrawl-mcp-server 3.20.2 is affected; only that version is named in the data, so other versions may also be vulnerable. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns only a 0.7% probability of exploitation within 30 days.

What to do: Inventory deployments of firecrawl-mcp-server and check the running version, and upgrade to a patched release when one is published, since no fixed version is stated in the available data. Until then, restrict or validate the filePath argument to an allowlisted directory, avoid pointing firecrawl_parse at files containing secrets (e.g., .env, SSH keys, cloud credentials), or disable the tool until patched. Review model context and logs for any reads of sensitive files that may indicate prior exploitation.