Executive brief
MCP (Model Context Protocol) is a server that provides file creation tools via an API. A path traversal vulnerability in the create_file function allows attackers to write arbitrary files to any location on the server's filesystem, potentially corrupting configuration files, overwriting application code, or disrupting service availability.
Technical details
The create_file function in app/api/mcp/route.ts fails to validate that the resolved file path remains within the intended UPLOAD_DIR, allowing attackers to use "../" sequences to escape the directory and write arbitrary content. An unauthenticated attacker with network access to the MCP interface can exploit this remotely by providing a malicious filePath argument. A proof-of-concept demonstrating arbitrary file write outside the uploads directory is publicly available.
Affected products
- 03-lovepreetSingh MCP up to commit f95d035c5317fad81af9828286631053ccb23546
Timeline
- 2026-08-27: disclosed: Vulnerability reported via GitHub issue #3
- 2026-09-20: advisory: CVE-2026-94044 published