# CVE-2026-85606: firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath

> CVE-2026-85606: firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath. CVSS 7.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-85606
Last updated: 2026-09-23T17:17:45Z

- Published: 2026-09-04 14:32 UTC · Updated: 2026-09-23 17:17 UTC · Assigner: VulnCheck
- CVSS: 7.5 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.90%, 59th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-22

## Description

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl\_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.

## Affected vendors and products

- firecrawl: firecrawl-mcp-server

## Tracked companies

- [Firecrawl](https://rewindex.com/company/firecrawl.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-85606)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-85606)
- [https://github.com/firecrawl/firecrawl-mcp-server](https://github.com/firecrawl/firecrawl-mcp-server)
- [https://github.com/firecrawl/firecrawl-mcp-server/blob/v3.24.1/src/index.ts](https://github.com/firecrawl/firecrawl-mcp-server/blob/v3.24.1/src/index.ts)
- [https://github.com/firecrawl/firecrawl-mcp-server/issues/306](https://github.com/firecrawl/firecrawl-mcp-server/issues/306)
- [https://www.vulncheck.com/advisories/firecrawl-mcp-server-3.20.2-arbitrary-local-file-read-via-filepath](https://www.vulncheck.com/advisories/firecrawl-mcp-server-3.20.2-arbitrary-local-file-read-via-filepath)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-85606 · Markdown: https://rewindex.com/cve/CVE-2026-85606.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-85606 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:17.689Z