GenOffice HTTP MCP file store lets local users read documents
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
GenOffice through 0.11.505 has an incorrect permission assignment (CWE-732) in its HTTP MCP server file store that makes the storage directory world-readable. A local unprivileged user can read uploaded and generated documents from that directory, bypassing the HTTP bearer token.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to read client uploads and converted outputs, bypassing the HTTP bearer token.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| genspark-ai | GenOffice | up to 0.11.505 | — | No fix listed | CNA |
- GenOffice Vendorgenspark-ai Affected up to 0.11.505 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for GenOffice.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108582
- 2026-10-11 Alias added: GHSA-29j6-3xvc-79ff
- 2026-10-11 Priority changed: MEDIUM → LOW
- 2026-10-14 CISA SSVC decision points changed
References
Sources
- CVE-2026-108582 · CVE Program
- CVE-2026-108582 · NVD
- FIRST EPSS
- GHSA-29j6-3xvc-79ff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences