| Titolo | MAA-AI MaaMCP <= 1.1.1.dev6+g2e4a41287 Fixed in commit bbc9f62 Path Traversal |
|---|
| Descrizione | MaaMCP contains a path traversal vulnerability in the save_pipeline and load_pipeline MCP tools before commit bbc9f62. Both tools accept caller-controlled filesystem paths and use them for file operations without verifying that the resolved path remains within the configured pipelines directory.
An attacker able to invoke these MCP tools can use save_pipeline to overwrite arbitrary writable JSON files with attacker-controlled content. The load_pipeline tool can disclose arbitrary readable JSON object files and distinguish between nonexistent paths, non-files, invalid JSON files, and valid JSON files, providing a filesystem-probing oracle.
The vulnerability may be triggered by a malicious MCP client or through prompt injection against an MCP-enabled agent. It was fixed in commit bbc9f62 by resolving candidate paths and rejecting paths outside the configured pipelines directory. |
|---|
| Fonte | ⚠️ https://github.com/MAA-AI/MaaMCP/issues/31 |
|---|
| Utente | Mcfly_Zhang (UID 98877) |
|---|
| Sottomissione | 13/07/2026 00:24 (2 mesi fa) |
|---|
| Moderazione | 27/08/2026 18:15 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 396172 [MAA-AI MaaMCP fino a 1.1.1.dev6+g2e4a41287 pipeline_tools.py save_pipeline/load_pipeline directory traversal] |
|---|
| Punti | 20 |
|---|