CVE-2026-65695

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65695
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65695.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65695
Published
2026-07-23T16:20:44.117Z
Modified
2026-07-25T04:14:50.446630035Z
Severity
  • 7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Office-Word-MCP-Server 1.1.11 Path Traversal via document tools
Details

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the checkfilewriteable and ensuredocxextension helpers which perform no base-directory confinement or realpath validation.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65695.json",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/gongrzhe/office-word-mcp-server

Affected ranges

Type
GIT
Repo
https://github.com/gongrzhe/office-word-mcp-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a3bbbb6d6167e68cf855d73ef7dc6cd8cfbfedba
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.11"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.1.11

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65695.json"