AI AgentHigh
CVE-2025-71427: Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP c…
- Occurred
- Oct 1, 2026
- Published
- Oct 1, 2026
- Source
- NVD CVE
Summary
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse save_presentation, open_presentation, or manage_image output_path to overwrite any server-writable file or load external files.
Tags
- CVE
- CVE-2025-71427
- cvss:MEDIUM
- agent-fail:injection-direct
- agent-fail:authorization
- agent-cause:framework-bug
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: CVE describes an AI agent vulnerability allowing path traversal and prompt injection to overwrite server files.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8