{"uuid": "a10f00f4-1d87-4f21-ad5c-6583279b189d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54785", "type": "seen", "source": "https://gist.github.com/alon710/dc2fc48bf583407e8cd73eba1edb4959", "content": "# CVE-2026-54785: CVE-2026-54785: Local File Read via Directory Traversal in gemini-bridge MCP Server\n\n> **CVSS Score:** 6.2\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54785\n\n## Summary\nBetween versions 1.0.0 and 1.3.1, the gemini-bridge Model Context Protocol (MCP) server failed to restrict candidate file paths to the workspace root when processing files in inline mode. This allowed unauthenticated local users, or remote attackers executing prompt-injection payloads against connected AI agents, to traverse the directory tree and read arbitrary system files. The retrieved contents were subsequently forwarded to the external Gemini AI CLI and returned in the round-trip response.\n\n## TL;DR\nA path traversal vulnerability in gemini-bridge allows attackers to read arbitrary local files by exploiting improper canonicalization and a missing validation check in the server's inline payload preprocessor.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Secondary CWE ID**: CWE-200\n- **Attack Vector**: Local\n- **CVSS v3.1 Score**: 6.2\n- **Exploit Maturity**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- gemini-bridge installations running versions 1.0.0 through 1.3.0\n- **gemini-bridge**: >= 1.0.0, < 1.3.1 (Fixed in: `1.3.1`)\n\n## Mitigation\n\n- Upgrade gemini-bridge to version 1.3.1 or newer.\n- Restrict the service execution environment to low-privilege user accounts.\n- Containerize the MCP server to restrict absolute directory reach.\n- Sanitize client-side tools to override arbitrary directory arguments supplied by LLMs.\n\n**Remediation Steps:**\n1. Execute pip install --upgrade gemini-bridge to retrieve version 1.3.1.\n2. Verify that the active daemon or integration shell is restarted to load the patched mcp_server module.\n3. Run system-level tests with symbolic links and parent traversal targets to confirm the rejection logic.\n\n## References\n\n- [GitHub Security Advisory (GHSA-c5px-58j2-7fqp)](https://github.com/eLyiN/gemini-bridge/security/advisories/GHSA-c5px-58j2-7fqp)\n- [Pull Request #9](https://github.com/eLyiN/gemini-bridge/pull/9)\n- [Fix Commit (8f3b85a)](https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801)\n- [Release Tag (v1.3.1)](https://github.com/eLyiN/gemini-bridge/releases/tag/v1.3.1)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54785)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54785) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T00:31:31.758794Z"}