CVE-2026-79743 in MCPHub
Summary
by MITRE • 08/31/2026
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest is directly concatenated into a file path (line 107) without any sanitization or path traversal character validation. An attacker can craft a malicious MCPB file where manifest.name is set to something like ../../../etc/malicious, causing the file to be extracted to an arbitrary location on the file system. The cleanupOldMcpbServer function (line 110) also uses the unsanitized name, potentially allowing deletion of arbitrary directories. This issue has been patched in version 0.12.13.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in MCPHub prior to version 0.12.13 represents a critical path traversal and directory manipulation flaw within the file upload handling mechanism. MCPHub serves as a centralized orchestration layer for managing multiple Model Context Protocol servers, allowing administrators to dynamically configure routing strategies and endpoints. The security defect resides specifically in the handler responsible for processing uploaded MCPB files, which are essentially ZIP archives containing server configurations. When an administrator uploads such a file, the system extracts its contents and reads a manifest.json file to determine configuration parameters. A fundamental lack of input validation occurs when the name field from this manifest is directly concatenated into a filesystem path without any sanitization or verification against directory traversal sequences.
This architectural oversight allows for arbitrary file write operations through crafted ZIP archives. By setting the name field in the manifest.json to include relative path components such as ../../../etc/malicious, an attacker can force the extraction process to place files outside of the intended application directory structure. This capability effectively bypasses sandboxing or isolation boundaries that might otherwise restrict where uploaded configuration data is stored. The immediate operational impact includes the potential for overwriting critical system configuration files, injecting malicious scripts into executable directories, or establishing persistence mechanisms by placing backdoors in locations accessible to other services running on the host system.
Beyond file creation, the vulnerability extends to destructive capabilities through the cleanupOldMcpbServer function. This routine also utilizes the unsanitized name field from the manifest without validation. Consequently, an attacker can manipulate this value to target arbitrary directories for deletion rather than just specific files within the application's scope. The ability to delete arbitrary directories poses a severe risk to system stability and availability, potentially leading to denial of service conditions by removing essential operational data or configuration structures required by MCPHub or dependent services. This dual nature of the flaw—enabling both unauthorized file placement and destructive directory removal—significantly elevates its severity from a simple input validation error to a critical compromise of integrity and availability.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The exploitation technique involves manipulating user-controlled input to access resources outside the intended scope, which is further categorized under CWE-73: External Control of File Name or Path in many security taxonomies. In terms of offensive cyber operations and threat modeling, this flaw facilitates initial code execution or privilege escalation depending on the context of the running service, mapping closely to ATT&CK technique T1059 Command and Scripting Interpreter if malicious scripts are injected, or T1486 Data Encrypted for Impact if used in conjunction with ransomware deployment. The lack of sanitization represents a fundamental failure in secure coding practices regarding file system interactions.
The remediation strategy implemented in version 0.12.13 addresses these issues by introducing rigorous validation and sanitization logic before any path construction occurs. Secure implementations must ensure that extracted filenames are resolved to absolute paths and verified against an allowlist of permitted directories or canonicalized to prevent traversal sequences from altering the intended destination. Additionally, the cleanup function should validate that target paths remain within expected boundaries before executing deletion operations. Organizations running affected versions of MCPHub must upgrade immediately to version 0.12.13 or later to mitigate these risks. Until patching is complete, administrators should restrict file upload capabilities to trusted sources only and monitor filesystem integrity for unauthorized changes in critical directories such as /etc or application-specific data stores.