[Security] Arbitrary file read and exfiltration via voice_clone file parameter

[Correctover]

Summary

The voice_clone() tool accepts an arbitrary local file path via the file parameter without validating file type before reading and uploading it to the MiniMax API.

Details

File: minimax_mcp/server.py, function voice_clone()

if is_url:
    response = requests.get(file, stream=True)  # SSRF
    files = {"file": ("audio_file.mp3", response.raw, "audio/mpeg")}
else:
    with open(file, "rb") as f:  # Arbitrary file read
        files = {"file": f}
    response_data = api_client.post("/v1/files/upload", files=files, data=data)

No validation of file type, content, or path confinement.

Impact

• Read SSH keys, credentials, source code
• Exfiltrate sensitive data via API upload

Suggested Fix

Validate file extension, check magic bytes, enforce path confinement to base_path.

Reported by Correctover Security Research (https://correctover.com)