Firecrawl's MCP server discloses a high-severity local file read flaw, and the npm package has not shipped a confirmed fix

VulnCheck published CVE-2026-85606 on 2026-09-04 against firecrawl-mcp-server, Firecrawl's official MCP server. The firecrawl_parse tool accepts a filePath argument to read a local file for parsing, but the argument was not confined to any directory, so an absolute path or a traversal sequence let a caller read sensitive files such as credentials or environment variables, which the tool then uploaded and returned inside the model's context. VulnCheck rated the flaw high, CVSS 3.1 7.5 and CVSS 4.0 8.7, and lists version 3.24.0 and earlier as affected.

A confirmed fix could not be established. The CNA record's own reference points at the source of src/index.ts at the git tag v3.24.1 in the firecrawl-mcp-server repository, and the affected range ending at 3.24.0 implies that tag is the fix. But the commit that tag points to, dated 2026-08-26, describes an unrelated change ("Publish the renderer deduplication fix from #386"), and the source at that same tag still calls path.resolve(filePath) directly with no check confining the result to an allowed directory, the pattern the advisory itself describes as the vulnerability. The npm package firecrawl-mcp, which is how the server is actually installed, has not published a release past 3.24.0 as of this fetch: the registry's latest tag is still the version VulnCheck lists as affected.

The three dates sit far apart. The reporter's own issue on the repository, #306, opened 2026-07-08, states the flaw was first reported by email on 2026-06-05 with no response; the issue remained open with no comments on 2026-09-15. VulnCheck's record followed on 2026-09-04. As of 2026-09-15 the main branch, last pushed 2026-09-14, still carries the same two lines, path.resolve(filePath) followed by readFile(absPath), so no fix date can be stated. Firecrawl publishes the server as a first-party npm package and also hosts a remote endpoint at mcp.firecrawl.dev. No GitHub-hosted security advisory exists on the repository for this record; VulnCheck's CNA record and advisory page are the only primary disclosure.