T05 · Unauthorized Access and Privilege Escalation
Error
- Location
mcp-servers/openai-gpt-image/src/index.ts:202- Finding
Unrestricted Local File Read and External Upload Through edit-image
- Content
View full analysis
{ if (!val) return true; // Check for Unix/Linux/macOS absolute paths if (val.startsWith("/")) return true; // Check for Windows absolute paths (C:/, D:\, etc.) if (/^[a-zA-Z]:[/\\]/.test(val)) return true; return false; }; const imageInputSchema = z.string().refine( (val) => absolutePathCheck(val) || base64Check(val), { message: "Must be an absolute path or a base64-encoded string (optionally as a data URL)" } ).describe("Absolute path to an image file (png, jpg, webp < 25MB) or a base64-encoded image string."); const editImageBaseSchema = z.object({ image: z.string().describe("Absolute image path or base64 string to edit."), prompt: z.string().max(32000).describe("A text description of the desired edit. Max 32000 chars."), mask: z.string().optional().describe("Optional absolute path or base64 string for a mask image (png < 4MB, same dimensions as the first image). Fully transparent areas indicate where to edit."), model: z.enum(["gpt-image-1.5", "gpt-image-1", "gpt-image-1-mini"]).default("gpt-image-1.5"), n: z.number().int().min(1).max(10).optional().describe("Number of images to generate (1-10)."), quality: z.enum(["auto", "high", "medium", "low"]).optional().describe("Quality (high, medium, low) - only for gpt-image-1."), size: z.enum(["1024x1024", "1536x1024", "1024x1536", "auto"]).optional().describe("Size of the generated images."), user: z.string().optional().describe("Optional user identifier for OpenAI monitoring."), output: z.enum(["base64", "file_output"]).default("base64").describe("Output format: base64 or file path."), file_output: z.string().refine(absolutePathCheck, { message: "Path must ...[truncated 3690 chars]- Remediation
View remediation