DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54785: CVE-2026-54785: Local File Read via Directory Traversal in gemini-bridge MCP Server

#security #cve #cybersecurity

CVE-2026-54785: Local File Read via Directory Traversal in gemini-bridge MCP Server

Vulnerability ID: CVE-2026-54785
CVSS Score: 6.2
Published: 2026-07-31

Between versions 1.0.0 and 1.3.1, the gemini-bridge Model Context Protocol (MCP) server failed to restrict candidate file paths to the workspace root when processing files in inline mode. This allowed unauthenticated local users, or remote attackers executing prompt-injection payloads against connected AI agents, to traverse the directory tree and read arbitrary system files. The retrieved contents were subsequently forwarded to the external Gemini AI CLI and returned in the round-trip response.

TL;DR

A path traversal vulnerability in gemini-bridge allows attackers to read arbitrary local files by exploiting improper canonicalization and a missing validation check in the server's inline payload preprocessor.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Secondary CWE ID: CWE-200
  • Attack Vector: Local
  • CVSS v3.1 Score: 6.2
  • Exploit Maturity: Proof-of-Concept (PoC)
  • CISA KEV Status: Not Listed
  • Ransomware Use: No

Affected Systems

  • gemini-bridge installations running versions 1.0.0 through 1.3.0
  • gemini-bridge: >= 1.0.0, < 1.3.1 (Fixed in: 1.3.1)

Code Analysis

Commit: 8f3b85a

Fix path traversal in inline file read workflow

Mitigation Strategies

  • Upgrade gemini-bridge to version 1.3.1 or newer.
  • Restrict the service execution environment to low-privilege user accounts.
  • Containerize the MCP server to restrict absolute directory reach.
  • Sanitize client-side tools to override arbitrary directory arguments supplied by LLMs.

Remediation Steps:

  1. Execute pip install --upgrade gemini-bridge to retrieve version 1.3.1.
  2. Verify that the active daemon or integration shell is restarted to load the patched mcp_server module.
  3. Run system-level tests with symbolic links and parent traversal targets to confirm the rejection logic.

References

Read the full report for CVE-2026-54785 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)