Summary
Code Graph RAG's paginated file-reading path can access files outside the configured project directory because it does not verify that the requested path remains within that directory. A caller who can reach the vulnerable MCP tool may read UTF-8-readable files accessible to the server process, including sensitive credentials or configuration.
Code Graph RAG's paginated file-reading path can access files outside the configured project directory because it does not verify that the requested path remains within that directory. A caller who can reach the vulnerable MCP tool may read UTF-8-readable files accessible to the server process, including sensitive credentials or configuration.
Affected context
The issue occurs in MCPToolsRegistry.read_file in codebase_rag/mcp/tools.py when offset or limit selects the paginated branch. That branch joins the supplied path to the project root without resolving it and checking containment, unlike the non-paginated branch, which uses path validation. Network-exposed HTTP MCP servers may be reachable by unauthenticated callers; local callers using the stdio transport can also reach the same code path.
The issue occurs in MCPToolsRegistry.read_file in codebase_rag/mcp/tools.py when offset or limit selects the paginated branch. That branch joins the supplied path to the project root without resolving it and checking containment, unlike the non-paginated branch, which uses path validation. Network-exposed HTTP MCP servers may be reachable by unauthenticated callers; local callers using the stdio transport can also reach the same code path.
Exploit preconditions
- Attack surface: The MCP
read_filetool, via HTTP or local stdio transport - Required access: A caller must be able to invoke the tool; the HTTP interface may allow unauthenticated access if exposed without authentication
- Trigger point: A read request that selects the paginated branch using offset or limit
- Why exploitation is possible: The paginated branch does not resolve the requested path and verify that it remains inside the project root before opening it
- Read scope: Files must be accessible to the server process and readable as UTF-8
- Attack surface: The MCP
read_filetool, via HTTP or local stdio transport - Required access: A caller must be able to invoke the tool; the HTTP interface may allow unauthenticated access if exposed without authentication
- Trigger point: A read request that selects the paginated branch using offset or limit
- Why exploitation is possible: The paginated branch does not resolve the requested path and verify that it remains inside the project root before opening it
- Read scope: Files must be accessible to the server process and readable as UTF-8
Why this happens
The paginated file-reading branch joins a caller-controlled path to the project root but omits canonical path resolution and containment validation. Absolute paths can replace the configured root, and relative traversal can escape it. This is a path traversal flaw mapped to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
The paginated file-reading branch joins a caller-controlled path to the project root but omits canonical path resolution and containment validation. Absolute paths can replace the configured root, and relative traversal can escape it. This is a path traversal flaw mapped to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Potential impact
- An attacker may read credentials, private keys, environment data, source code, or configuration files accessible to the process.
- Sensitive information could be used to access other systems or services.
- Exposure of private source or configuration data could aid further attacks.
- An attacker may read credentials, private keys, environment data, source code, or configuration files accessible to the process.
- Sensitive information could be used to access other systems or services.
- Exposure of private source or configuration data could aid further attacks.
General mitigation guidance
Defensive patterns include:
- Resolve requested paths to canonical paths and verify containment within the permitted project root before opening any file.
- Apply the same path validation to every code path, including paginated reads.
- Prefer APIs or abstractions that restrict file access to an explicitly defined root.
- Reduce trust in caller-supplied paths and reject absolute paths or traversal components where appropriate.
- Limit the server process's filesystem permissions and avoid storing sensitive files in locations it can read unnecessarily.
- Require authentication and restrict network exposure for MCP endpoints.
Defensive patterns include:
- Resolve requested paths to canonical paths and verify containment within the permitted project root before opening any file.
- Apply the same path validation to every code path, including paginated reads.
- Prefer APIs or abstractions that restrict file access to an explicitly defined root.
- Reduce trust in caller-supplied paths and reject absolute paths or traversal components where appropriate.
- Limit the server process's filesystem permissions and avoid storing sensitive files in locations it can read unnecessarily.
- Require authentication and restrict network exposure for MCP endpoints.
How teams detect issues like this
- Use static analysis to identify file-opening operations that consume user-controlled paths without canonicalization and containment checks.
- Review all file-reading branches for consistent validation, especially paginated or alternate code paths.
- Test that absolute paths and relative traversal cannot access files outside the configured root.
- Apply policy checks requiring path validation before filesystem access and authentication for network-exposed MCP tools.
- Automated code review tools can help flag untrusted path inputs flowing into file operations.
- Use static analysis to identify file-opening operations that consume user-controlled paths without canonicalization and containment checks.
- Review all file-reading branches for consistent validation, especially paginated or alternate code paths.
- Test that absolute paths and relative traversal cannot access files outside the configured root.
- Apply policy checks requiring path validation before filesystem access and authentication for network-exposed MCP tools.
- Automated code review tools can help flag untrusted path inputs flowing into file operations.
