[Security Audit] Comprehensive Security Report: 5 Vulnerabilities Found

[Correctover]

MiniMax-MCP Security Audit Report

Auditor: Correctover Security Research (https://correctover.com)
Date: 2026-07-17
Version: commit f4d6a61 (2026-05-21)
Status: 5 vulnerabilities identified

---

Summary

We conducted a security audit of MiniMax-MCP and identified 5 security vulnerabilities (2 High, 2 Medium, 1 Low). These issues could allow attackers to:

• Write arbitrary files to the host system
• Read sensitive files (SSH keys, credentials)
• Access internal network services (SSRF)
• Exfiltrate data via API endpoints

---

Vulnerability Overview

#	Severity	Issue	Location	Reference
1	🔴 High	Path traversal in output writes	utils.py	#96
2	🔴 High	Arbitrary file read (no type validation)	server.py	#97
3	🟡 Medium	SSRF (no URL validation)	server.py	#98
4	🟡 Medium	Arbitrary file read via video generation	server.py	#99
5	🟢 Low	No authentication (stdio mode)	MCP protocol	Design issue

---

Issue #1: Path Traversal in Output Writes (High)

File: minimax_mcp/utils.py - build_output_path()

Problem: The function accepts absolute paths for output_directory without validating they stay within the base directory.

# Current code
if output_directory is None:
    output_path = Path(os.path.expanduser(base_path))
elif not os.path.isabs(os.path.expanduser(output_directory)):
    output_path = Path(os.path.expanduser(base_path)) / Path(output_directory)
else:
    output_path = Path(os.path.expanduser(output_directory))  # ❌ No path confinement

Impact: Attackers can write files to any writable location:

• Overwrite system files (cron jobs, shell configs)
• Plant backdoors in application directories
• Write SSH public keys to ~/.ssh/authorized_keys

Suggested Fix:

output_path = Path(os.path.expanduser(output_directory)).resolve()
base_resolved = Path(os.path.expanduser(base_path)).resolve()
if not str(output_path).startswith(str(base_resolved)):
    raise MinimaxMcpError("Output path outside allowed directory")

Affected tools: text_to_audio, voice_clone, generate_video, text_to_image, music_generation

---

Issue #2: Arbitrary File Read (High)

File: minimax_mcp/server.py - voice_clone()

Problem: The file parameter accepts any local file path without type validation. Files are read and uploaded to the API.

# Current code
else:
    if not os.path.exists(file):
        raise MinimaxMcpError(f"Local file does not exist: {file}")
    with open(file, "rb") as f:  # ❌ Reads any file
        files = {"file": f}
    response_data = api_client.post("/v1/files/upload", files=files, data=data)

Impact:

• Read SSH private keys (~/.ssh/id_rsa)
• Read credentials (.env files, database configs)
• Read source code and sensitive documents
• Data exfiltration via API upload

Suggested Fix:

1. Validate file extension (only .wav, .mp3, .m4a, .aac)
2. Check file magic bytes to ensure valid audio
3. Restrict file paths to MINIMAX_MCP_BASE_PATH

---

Issue #3: SSRF (Medium)

File: minimax_mcp/server.py - voice_clone(), play_audio()

Problem: When is_url=True, URLs are fetched without validation.

# voice_clone
if is_url:
    response = requests.get(file, stream=True)  # ❌ No URL validation

# play_audio
if is_url:
    play(requests.get(input_file_path).content)  # ❌ No URL validation

Impact:

• Access cloud instance metadata (http://169.254.169.254/)
• Scan internal network services
• Access internal APIs not exposed to the internet

Suggested Fix:

import ipaddress

BLOCKED_RANGES = [
    ipaddress.ip_network("10.0.0.0/8"),
    ipaddress.ip_network("172.16.0.0/12"),
    ipaddress.ip_network("192.168.0.0/16"),
    ipaddress.ip_network("169.254.0.0/16"),  # Cloud metadata
    ipaddress.ip_network("127.0.0.0/8"),
]

def validate_url(url: str) -> str:
    parsed = urlparse(url)
    if parsed.scheme not in {"https"}:
        raise MinimaxMcpError(f"Only HTTPS allowed")
    try:
        ip = ipaddress.ip_address(parsed.hostname)
        for network in BLOCKED_RANGES:
            if ip in network:
                raise MinimaxMcpError("Access to internal networks blocked")
    except ValueError:
        pass  # hostname, DNS check needed
    return url

---

Issue #4: Arbitrary File Read via Video Generation (Medium)

File: minimax_mcp/server.py - generate_video()

Problem: first_frame_image parameter reads arbitrary files and base64-encodes them to the API.

if not first_frame_image.startswith(("http://", "https://", "data:")):
    with open(first_frame_image, "rb") as f:
        image_data = f.read()  # ❌ Reads any file
        first_frame_image = f"data:image/jpeg;base64,{base64.b64encode(image_data).decode()}"

Impact: Same as Issue #2 - arbitrary file read with data exfiltration.

Suggested Fix: Validate file extension (.jpg, .png, .gif), check image magic bytes, enforce path confinement.

---

Issue #5: No Authentication (Low)

MCP stdio mode has no authentication. Any local process can connect and use all tools.

Impact: In multi-user environments or containers, malicious processes could abuse the MCP service.

Note: This is a limitation of the MCP protocol itself, not specific to MiniMax.

---

Recommendations

Immediate Actions

1. Path confinement: Restrict all file operations to MINIMAX_MCP_BASE_PATH
2. File type validation: Check extensions + magic bytes
3. URL allowlisting: Block internal networks and metadata endpoints
4. Input validation: Strict validation on all user inputs

Long-term Improvements

1. Implement least-privilege principles
2. Add operation audit logging
3. Implement rate limiting
4. Consider implementing authentication

Runtime Security

Consider using a runtime security layer like CCS (Runtime Security Conformance Standard) or Correctover to intercept these vulnerability classes automatically.

---

Disclosure Timeline

Date	Event
2026-07-17	Audit completed, vulnerabilities reported

---

About the Auditor

Correctover is focused on MCP runtime security research:

• CCS Standard: Runtime Security Conformance Standard for MCP
• Correctover SDK: CCS reference implementation (22μs P50 latency)
• Research: 80K+ MCP fault data points, 215 fault patterns

Website: https://correctover.com
GitHub: https://github.com/Correctover
CCS Standard: https://github.com/Correctover/standards

---

This report follows responsible disclosure practices. All vulnerabilities were verified but not tested in production environments.