File Path Vulnerability in Wireshark MCP from Wireshark
CVE-2026-43901

6.8MEDIUM

Key Information:

Vendor

Bx33661

Status
Wireshark-mcp
Vendor
CVE Published:
11 May 2026

What is CVE-2026-43901?

The Wireshark MCP is a server that integrates tshark with additional utilities for structured analysis. A vulnerability exists in versions 1.1.5 and earlier, where the wireshark_export_objects MCP tool allows an attacker to manipulate the dest_dir parameter. This parameter is used with tshark's --export-objects flag without proper path restrictions, meaning that by default, the export sandbox (_allowed_dirs) is set to None. In normal installations, any directory on the system can be specified as a destination for file exports, potentially leading to unauthorized access to sensitive files.

Affected Version(s)

Wireshark-MCP <= 1.1.5

References

https://github.com/bx33661/Wireshark-MCP/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.