Executive brief
MCPHub is a Model Context Protocol file hosting and distribution platform. An attacker can upload a malicious MCPB package file with a specially crafted manifest name containing path traversal sequences (like `../../../etc/malicious`), causing files to be extracted to arbitrary locations on the server's filesystem. This could lead to overwriting critical files, modifying application configuration, or deleting important directories, disrupting service availability and potentially compromising the integrity of deployed servers.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in the MCPB file upload handler (src/controllers/mcpbController.ts:107). The `name` field from a user-supplied JSON manifest inside an uploaded ZIP archive is read without sanitization and directly concatenated into a filesystem path passed to `fs.mkdirSync()` and `fs.renameSync()`. An attacker can craft a malicious MCPB file with a manifest containing `name: "../../../etc/malicious"`, causing the extraction logic to write files outside the intended directory. The vulnerability requires authentication (the upload endpoint requires a login session based on typical web app patterns) but no other preconditions. The attack can achieve arbitrary directory creation, file movement, and deletion of existing directories via the `cleanupOldMcpbServer()` function. A patch is available in version 0.12.13.
Affected products
- samanhappy MCPHub <0.12.13
Timeline
- 2026-04-22: disclosed
- 2026-04-19: patched: Fixed in version 0.12.13