Path Traversal in Godot-MCP Application

Executive Summary

CVE-2026-15522 is a security flaw in the godot-mcp project, specifically in the run_project component's validatePath function. The vulnerability arises because the projectPath argument is not properly validated, allowing path traversal attacks when called locally.

An attacker can specify any writable local directory containing a Godot project file, causing the server to inject a malicious script into that project directory. This script enables a persistent runtime-control channel capable of executing arbitrary code.

The injected code executes automatically when the victim opens or runs the modified project, allowing persistent unauthorized control. The vulnerability does not require Godot to be installed or launched, as the malicious files are written before the Godot process starts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to persistent unauthorized code execution on any writable local Godot project accessible to the MCP server process.

An attacker with local access can inject malicious scripts that run automatically, potentially compromising the integrity and security of your Godot projects.

This could result in arbitrary code execution, unauthorized modifications to project files, and persistent backdoors that execute whenever the project is opened or run.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves manipulation of the projectPath argument leading to path traversal and persistent injection of a malicious script into writable local Godot project directories. Detection involves checking for unauthorized modifications in project directories, specifically the presence of the injected script file `mcp_interaction_server.gd` and changes to the `project.godot` file that add autoload entries pointing to this script.

To detect this on your system, you can search for the injected script and suspicious autoload entries in Godot project directories accessible to the MCP server process.

• Find all instances of the injected script: `find /path/to/projects -name mcp_interaction_server.gd`
• Check for autoload entries in `project.godot` files referencing the injected script: `grep -r 'mcp_interaction_server.gd' /path/to/projects`

Since the vulnerability requires local access and involves filesystem writes before Godot runs, monitoring filesystem changes in project directories or auditing recent modifications to `project.godot` files can also help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the affected component godot-mcp to version 3.0.0 or later, as this version includes a patch that fixes the vulnerability.

The patch introduces an allowlist environment variable (`GODOT_MCP_ALLOWED_DIRS`) to restrict project execution to trusted directories, preventing unauthorized path traversal and injection.

Additionally, ensure that only trusted users have local access to the MCP server environment, as the exploit requires local attack vector.

Review and restrict writable permissions on Godot project directories to prevent unauthorized modifications.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker with local access to perform path traversal and inject persistent malicious scripts into writable local Godot project directories. This unauthorized code execution and modification of project files could lead to unauthorized access or manipulation of sensitive data if such data is stored or processed within affected projects.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the ability to execute arbitrary code and persistently modify project files could potentially lead to breaches of confidentiality, integrity, and availability of data. Such breaches may result in non-compliance with data protection regulations that require safeguarding personal or sensitive information.

Therefore, organizations using the affected component without applying the patch or upgrade to version 3.0.0 risk violating compliance requirements related to data security and privacy, especially if the compromised environment handles regulated data.

Useful 0 Not Useful 0