| Title | 03-lovepreetSingh MCP f95d035c5317fad81af9828286631053ccb23546 Path Traversal |
|---|
| Description | An arbitrary file write vulnerability (CWE-22) has been identified in the create_file MCP tool of 03-lovepreetSingh MCP, commit f95d035c5317fad81af9828286631053ccb23546. The tool accepts attacker-controlled filePath and content arguments and joins the supplied path with the intended uploads directory without verifying that the resolved destination remains within that directory. An attacker with access to the MCP interface can use path traversal sequences to create or overwrite arbitrary files writable by the server process, potentially causing source or configuration corruption, service disruption, or further compromise. A working exploit has been demonstrated by writing attacker-controlled content outside the uploads directory. This product does not use versioning, so affected and unaffected release information is unavailable, and no fixed version is known at the time of reporting. |
|---|
| Source | ⚠️ https://github.com/03-lovepreetSingh/MCP/issues/3 |
|---|
| User | Xh1Xxhg (UID 90906) |
|---|
| Submission | 08/27/2026 05:15 (24 days ago) |
|---|
| Moderation | 09/19/2026 23:29 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 407973 [03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546 app/api/mcp/route.ts create_file filePath/content path traversal] |
|---|
| Points | 20 |
|---|