CVE-2025-71427Published

Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage_image

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-71427 · Microsoft / collected KEV context

cve-program · CVE-2025-71427

https://github.com/GongRzhe/Office-PowerPoint-MCP-Server/pull/33
https://github.com/GongRzhe/Office-PowerPoint-MCP-Server/blob/3631ba2ec0c24504476f78bf74d329c9be11caaa/utils/presentation_utils.py#L61-L73
https://github.com/GongRzhe/Office-PowerPoint-MCP-Server/blob/3631ba2ec0c24504476f78bf74d329c9be11caaa/tools/presentation_tools.py#L127-L141
https://github.com/GongRzhe/Office-PowerPoint-MCP-Server
https://www.vulncheck.com/advisories/office-powerpoint-mcp-server-through-2.0.7-path-traversal-via-save-presentation-and-manage-image

Related operational evidence

Explicit CVE identifiers

No related operational record is retained in the current change model.