Path traversal flaw found in PowerPoint MCP server

A vulnerability disclosed on 1 October 2026 in the Office-PowerPoint-MCP-Server, an open source project published by the developer GongRzhe, allows callers to read and write files anywhere the server process has access to, rather than only inside its intended working directory. The flaw is tracked as CVE-2025-71427 and affects all versions through 2.0.7, according to the entry in the US National Vulnerability Database.

The server is an MCP server, meaning it exposes a set of tools that an AI agent can call to get work done, in this case creating and editing PowerPoint files. According to the NVD record, MCP callers can escape the working directory simply by supplying an absolute path or a path containing "../" sequences, which move up through the directory tree. The server does not constrain where the resulting read or write lands.

Three tool functions are named in the advisory as the route in: save_presentation, open_presentation, and the output_path argument of manage_image. The NVD entry says attackers can steer an AI agent via prompt injection to abuse those functions, either to overwrite any file the server is able to write to, or to load external files from the host.

Prompt injection is the technique of hiding instructions in content that an agent reads, such as a document, a web page or a file name, so that the agent follows the attacker's instructions instead of the user's. That matters here because the agent is the thing making the tool calls. A user does not need to ask for a file outside the working directory to be touched. Text the agent processes along the way can be enough to produce the call, and the server will carry it out because it does not validate the path.

The practical consequence described in the advisory is twofold. On the write side, saving a presentation to an attacker-chosen path means any server-writable file can be overwritten, which on a shared or long-running host could include configuration or startup files. On the read side, opening a presentation or pulling in an image from an arbitrary path means files outside the project can be loaded into the agent's context.

The NVD record lists references including the project's GitHub repository, two specific line ranges in the source files presentation_tools.py and presentation_utils.py where the path handling sits, a pull request numbered 33 against the repository, and an advisory published by VulnCheck. The incident record compiled from these sources lists the status of the issue as reported.

MCP servers of this kind are typically run locally alongside a coding or productivity agent, and they often inherit the file system permissions of the user who started them. The advisory does not state how widely the server is deployed, and no exploitation in the wild is described in the sources. Operators running the server should check which version they have and review the referenced repository and pull request for the current state of the code.