CVE-2026-108582

MEDIUM 5.5

GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to read client uploads and converted outputs, bypassing the HTTP bearer token.

CWE	CWE-732
Vendor	genspark-ai
Product	genoffice
Published	Oct 10, 2026

Stay Ahead of the Next One

Get instant alerts for genspark-ai genoffice

Be the first to know when new medium vulnerabilities affecting genspark-ai genoffice are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

genspark-ai / GenOffice

0 ≤ 0.11.505

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@haind/genoffice-http-mcp-temp-file-disclosure github.com: https://github.com/genspark-ai/genoffice/blob/v0.11.505/packages/cli/src/mcp/files.ts#L70-L90 github.com: https://github.com/genspark-ai/genoffice/releases/tag/v0.11.505 vulncheck.com: https://www.vulncheck.com/advisories/genoffice-through-0.11.505-insecure-permissions-in-http-mcp-server-file-store

Credits

HaiND from the Post and Telecommunication Institute of Technology