Is CVE-2026-79743 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79743 being exploited in the wild.

How severe is CVE-2026-79743?

Medium severity, with a CVSS score of 4, published 31 August 2026.

Which products and versions are affected?

@samanhappy/mcphub (npm) SEMVER:introduced=0,fixed=0.12.13; Samanhappy Mcphub <0.12.13.

Is there a fix for CVE-2026-79743?

Yes. @samanhappy/mcphub (npm): upgrade to 0.12.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79743 attacked?

It is attacked over the network.

Am I affected by CVE-2026-79743?

Check whether you run @samanhappy/mcphub (npm) or Samanhappy Mcphub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79743: MCPHub path traversal via malicious MCPB manifest name

Q: Is there a fix for CVE-2026-79743?

Yes. @samanhappy/mcphub (npm): upgrade to 0.12.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-79743 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-79743?

Check whether you run @samanhappy/mcphub (npm) or Samanhappy Mcphub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79743 · Severity: medium · CVSS 4 · Published 2026-08-31

MCPHub is a Model Context Protocol file hosting and distribution platform. An attacker can upload a malicious MCPB package file with a specially crafted manifest name containing path traversal sequences (like `../../../etc/malicious`), causing files to be extracted to arbitrary locations on the server's filesystem. This could lead to overwriting critical files, modifying application configuration, or deleting important directories, disrupting service availability and potentially compromising the integrity of deployed servers.

Technologies: @samanhappy/mcphub (npm), Samanhappy Mcphub. Vendors: npm, Samanhappy.

Quick answers

Is CVE-2026-79743 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79743 being exploited in the wild.
How severe is CVE-2026-79743?: Medium severity, with a CVSS score of 4, published 31 August 2026.
Which products and versions are affected?: @samanhappy/mcphub (npm) SEMVER:introduced=0,fixed=0.12.13; Samanhappy Mcphub <0.12.13.
Is there a fix for CVE-2026-79743?: Yes. @samanhappy/mcphub (npm): upgrade to 0.12.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79743 attacked?: It is attacked over the network.
Am I affected by CVE-2026-79743?: Check whether you run @samanhappy/mcphub (npm) or Samanhappy Mcphub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@samanhappy/mcphub (npm): upgrade to 0.12.13 or later
```
npm install @samanhappy/mcphub@0.12.13
```

Technical details

The vulnerability is a classic path traversal (CWE-22) flaw in the MCPB file upload handler (src/controllers/mcpbController.ts:107). The `name` field from a user-supplied JSON manifest inside an uploaded ZIP archive is read without sanitization and directly concatenated into a filesystem path passed to `fs.mkdirSync()` and `fs.renameSync()`. An attacker can craft a malicious MCPB file with a manifest containing `name: "../../../etc/malicious"`, causing the extraction logic to write files outside the intended directory. The vulnerability requires authentication (the upload endpoint requires a login session based on typical web app patterns) but no other preconditions. The attack can achieve arbitrary directory creation, file movement, and deletion of existing directories via the `cleanupOldMcpbServer()` function. A patch is available in version 0.12.13.

Affected products

samanhappy MCPHub <0.12.13

Identifiers

CVE-2026-79743
GHSA-p3h2-2j4p-p83g

Timeline

2026-04-22: disclosed
2026-04-19: patched: Fixed in version 0.12.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.