CVE-2026-10264 in whatsapp-mcp
Summary
by MITRE • 06/01/2026
A vulnerability was determined in lharries whatsapp-mcp 0.0.1. Affected by this vulnerability is the function SendMessageRequest of the file whatsapp-bridge/main.go of the component Send API Endpoint. This manipulation of the argument mediaPath causes path traversal. The exploit has been publicly disclosed and may be utilized. Patch name: 6657cdceadd361e8fbe824afe9d00b4504009a5d. It is recommended to apply a patch to fix this issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/01/2026
The vulnerability identified in lharries whatsapp-mcp 0.0.1 represents a critical path traversal flaw within the SendMessageRequest function of the whatsapp-bridge/main.go file. This security weakness specifically affects the Send API Endpoint component and stems from improper handling of the mediaPath argument. The flaw allows attackers to manipulate file system access through crafted input parameters, potentially enabling unauthorized access to sensitive system resources. The vulnerability has been publicly disclosed and is actively exploitable, making it a pressing concern for any deployment utilizing this software component.
The technical implementation of this vulnerability falls under CWE-22 Path Traversal, which occurs when untrusted input is used to construct file paths without proper validation or sanitization. In this case, the mediaPath parameter in the SendMessageRequest function fails to adequately filter or validate user-supplied input, allowing malicious actors to traverse the file system hierarchy. Attackers can exploit this by crafting specially formatted paths that bypass normal access controls, potentially accessing files outside the intended directory boundaries. This weakness directly maps to the ATT&CK technique T1059.007 Command and Scripting Interpreter: PowerShell, where adversaries might leverage such path traversal vulnerabilities to gain unauthorized access to system files or execute malicious code through manipulated file paths.
The operational impact of this vulnerability extends beyond simple file access violations, as it could enable attackers to read sensitive configuration files, access database credentials, or even execute arbitrary code on the affected system. The exposed API endpoint becomes a potential entry point for attackers seeking to escalate privileges or extract confidential information from the messaging infrastructure. Given that this is a Send API Endpoint, the vulnerability could be exploited to manipulate message delivery, potentially leading to message interception, modification, or denial of service attacks against legitimate users.
Security remediation for this vulnerability requires immediate application of the provided patch identified by commit hash 6657cdceadd361e8fbe824afe9d00b4504009a5d. Organizations should prioritize patch deployment across all affected systems and conduct thorough security assessments to ensure complete remediation. Additionally, implementing input validation controls, least privilege access restrictions, and regular security scanning of the application codebase can help prevent similar vulnerabilities from emerging in future releases. The patch should be validated through regression testing to ensure that legitimate functionality remains intact while addressing the path traversal exploit vector.