High 2026-07-11

MCP/API Tool Argument LFI via Mixed-Encoding Path Separator or file:// URI Scheme Escape

Attackers can trick AI agent tools and APIs into reading sensitive system files like /etc/passwd by disguising the request. Instead of an obvious traversal pattern, they hide a single encoded slash or use a file:// link straight to a system directory, both of which slip past filters looking for '../' sequences.

How the attack works

An attacker sends a tool or API call with a file path argument (such as filename, path, source, or url) that looks mostly normal but contains one trick: either the slash right before a sensitive filename like 'etc/passwd' is percent-encoded (e.g. 'etc%2fpasswd') while the rest of the string is plain text, or the argument uses a file:// URI pointing directly at a system folder like 'file:///etc' with no traversal dots at all. Because there's no obvious '../' chain or fully-encoded string, filters built only to catch traversal chains miss it. The agent or backend API decodes the value and reads the targeted file or directory, handing its contents back to the attacker. This pattern was seen in real disclosed vulnerabilities in Ray, H2O, and MLflow APIs.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: 98f07a0e-2716-4500-ab78-56fe08dc7728
Severity: High
CVEs: CVE-2023-1177 CVE-2023-6021 CVE-2023-6038

Classification

AML.T0057 · LLM Data Leakage ASI01 · Agent Authorization and Control Hijacking LLM02 · Sensitive Information Disclosure

Why it matters

An attacker can read sensitive server files (credentials, password files, configuration) through a tool or API call that looks like normal file-path input, leading to data leakage or further compromise.

What you can do

→Validate and normalize file path arguments fully (decode all percent-encoding first, then check the result) before using them in file operations.
→Reject or restrict file:// URI schemes in tool/API arguments unless explicitly required, and block ones pointing at system directories.
→Apply an allowlist of permitted base directories for any argument used to read files, rather than trying to blocklist traversal patterns.
→Review logs for tool/API calls with path-like arguments containing 'etc', 'passwd', 'shadow', or 'system32' near unusual encoding.

Known benign look-alikes

A legitimate percent-encoded slash in an unrelated path that coincidentally contains the substring 'etc' immediately before it (e.g. a directory literally named 'etc' inside an application's own asset tree) -- rare enough combined with the passwd/shadow/system32 target list and the required key= prefix that this is an acceptable trade-off at experimental maturity
HTML/XML attributes (src=, SYSTEM ") pointing file:// at /etc are a related but distinct LFI/XXE surface intentionally left to other rules -- this rule is scoped to source/path/url/location tool-argument keys to avoid matching bare documentation examples of the XXE/iframe-src technique