{"cve":"CVE-2026-43901","nvd":{"published":"2026-05-11T23:20:21.697","modified":"2026-10-26T18:10:00.173","status":"Modified","description":"Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox (_allowed_dirs) is None by default and only activates when the environment variable WIRESHARK_MCP_ALLOWED_DIRS is explicitly set. In a default installation, any directory on the filesystem can be used as the export destination.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8},"cwes":["CWE-22"],"references":["https://github.com/bx33661/Wireshark-MCP/security/advisories/GHSA-3r68-x3xc-rxpg","https://github.com/bx33661/Wireshark-MCP/security/advisories/GHSA-3r68-x3xc-rxpg"],"products":["bx33661:wireshark_mcp"],"source":"nvd","synced_at":"2026-10-26T18:27:13.530666824+00:00"},"epss":{"cve":"CVE-2026-43901","score":0.00345,"percentile":0.27775,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-3r68-x3xc-rxpg","url":"https://osv.dev/vulnerability/GHSA-3r68-x3xc-rxpg","summary":"wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured","modified":"2026-07-13T16:43:07.322549535Z","packages":[{"ecosystem":"PyPI","name":"wireshark-mcp","purl":"pkg:pypi/wireshark-mcp","ranges":["<=1.1.5"],"fixed":[]}]},{"id":"PYSEC-2026-3426","url":"https://osv.dev/vulnerability/PYSEC-2026-3426","summary":"wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured","modified":"2026-07-13T16:33:05.760985243Z","packages":[{"ecosystem":"PyPI","name":"wireshark-mcp","purl":"pkg:pypi/wireshark-mcp","ranges":["<=1.1.5"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}