CVE-2026-66004 in blender-mcp
Summary
by MITRE • 07/24/2026
BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability under examination involves a path traversal flaw within BlenderMCP, a tool used for managing and downloading assets within the Blender 3D software environment. This issue specifically affects versions prior to commit 30a3308 and resides in the download_polyhaven_asset method which handles asset retrieval from the Poly Haven API. The core problem stems from inadequate input validation and sanitization of API response data, particularly within include keys that define file paths during the download process. When the application processes these include keys without proper path normalization or validation, it becomes susceptible to malicious input injection.
The technical exploitation mechanism relies on attackers injecting traversal sequences such as '../../.bashrc' into the API response include keys. This allows adversaries to manipulate the intended file destination and write content to arbitrary locations on the target system. The vulnerability is particularly dangerous because it can be leveraged through man-in-the-middle attacks where attackers intercept network traffic between the BlenderMCP client and the Poly Haven servers, or through prompt injection techniques that manipulate user input. When successful, this attack vector enables attackers to overwrite sensitive system files including shell configuration files like .bashrc, which can then be used to establish persistent access to the compromised system.
The operational impact of this vulnerability extends beyond simple file overwriting capabilities. By targeting critical system files such as .bashrc, attackers can inject malicious commands that execute automatically during user sessions, creating a foothold for further compromise. The vulnerability also represents a significant risk in environments where BlenderMCP is used with elevated privileges or in automated workflows, as it could enable privilege escalation or complete system takeover. Additionally, the attack surface is widened by the fact that this vulnerability can be exploited through network-based attacks rather than requiring physical access to the target system.
Mitigation strategies should focus on implementing robust input validation and path normalization within the download_polyhaven_asset method. The implementation must sanitize all API response include keys to prevent directory traversal sequences from being processed as legitimate file paths. Security controls should include absolute path validation, canonical path resolution, and the enforcement of strict file access controls that limit write permissions to intended directories only. Organizations should also consider implementing network security measures such as certificate pinning or strict transport security to prevent man-in-the-middle attacks that could facilitate this vulnerability exploitation. The fix should align with common security practices outlined in CWE-22 for path traversal vulnerabilities and should be consistent with ATT&CK technique T1059.007 for command and scripting interpreter usage, ensuring that the remediation addresses both the immediate vulnerability and broader attack surface considerations.
The vulnerability demonstrates how seemingly benign API integration can create significant security risks when proper input validation is omitted from critical processing paths. It highlights the importance of defense-in-depth strategies in software development, particularly when handling external data sources that may be manipulated by malicious actors. The issue also underscores the need for comprehensive security testing including threat modeling exercises that identify potential attack vectors through third-party API integrations and external resource handling mechanisms within application codebases.