CVE-2025-66689: Busymac Pal Mcp Server

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. The vulnerability is caused by flawed logic in the is_dangerous_path() validation function that uses exact string matching against a blacklist of system directories. Attackers can bypass these restrictions by accessing subdirectories of blacklisted paths.

Affected products

• Busymac Pal Mcp Server: before 9.8.2 (fixed in 9.8.2)

Published 2026-01-12. Last modified 2026-06-17.