CVE-2026-7217
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Deepractice PromptX up to version 2.4.0, an absolute path traversal vulnerability exists in the read_docx/read_xlsx/read_pptx/list_xlsx_sheets/read_pdf functions in packages/mcp-office/src/index.ts. The attack can be performed remotely.
Risk Assessment
An attacker could read arbitrary files on the server, potentially leading to leakage of confidential data or source code.
Recommendation
Immediately update PromptX to the latest version and validate file paths in document handling functions.
Original NVD description (English source)
A security vulnerability has been detected in Deepractice PromptX up to 2.4.0. The affected element is the function read_docx/read_xlsx/read_pptx/list_xlsx_sheets/read_pdf of the file packages/mcp-office/src/index.ts of the component Document File Handler. Such manipulation of the argument path leads to absolute path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.