Local File Read via Unsafe File Path Resolution in convert_to_markdown Tool

The convert_to_markdown tool appears to process file:// URIs without sufficient access control. When given the input file:///etc/passwd, the service returned content consistent with the deployment server's local /etc/passwd file.

This behavior suggests that the tool may resolve user-supplied file URIs and expose server-side local file-system content during document conversion. The issue was observed over stdio transport and may indicate insufficient validation of URI schemes, file paths, or accessible conversion sources.

We recommend restricting the input sources that the tool can convert. The tool should reject untrusted local file:// URIs, unless local file conversion is an intended feature and access is limited to a safe, allowlisted directory. If local file conversion is required, access should be limited to a dedicated allowlisted working directory, with path canonicalization and boundary checks applied before opening any file.

Start at the convert_to_markdown entry point and trace how file:// URIs are accepted during stdio conversion. Reproduce the reported /etc/passwd case in the existing test setup, then verify that untrusted local paths are rejected or constrained to a canonicalized allowlisted directory. Done means server-side files outside the permitted source area cannot be read.