CVE-2026-94044
Received Received - Intake

Path Traversal in 03-lovepreetSingh MCP

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description
A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function create_file of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-21
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94044
EUVD
EUVD-2026-83770

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
03-lovepreetsingh mcp to f95d035c5317fad81af9828286631053ccb23546 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability (CWE-22) in the MCP repository by 03-lovepreetSingh. It affects the create_file function in the file app/api/mcp/route.ts. The issue allows attackers to bypass directory restrictions by manipulating the filePath parameter with sequences like ../../../tmp/poc1.txt. This can lead to writing arbitrary files outside the intended uploads directory, potentially causing system compromise or service disruption.

Detection Guidance

Check for unusual file writes outside intended directories by monitoring logs for the create_file function calls with suspicious filePath parameters containing path traversal sequences like ../../../. Use tools like grep or auditd to search for these patterns in server logs or system files.

Impact Analysis

An attacker could exploit this to overwrite critical files, corrupt configurations, or disrupt services. Since the attack is remote and requires no authentication, any system running the vulnerable MCP version is at risk. The exploit could lead to data loss, unauthorized access, or further system compromise if combined with other vulnerabilities.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized file access or modification. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding health information. Exploitation could lead to data breaches, unauthorized disclosures, or integrity violations, resulting in legal penalties or loss of certification.

Mitigation Strategies

Immediately restrict filePath parameter inputs to prevent path traversal by validating and canonicalizing paths. Ensure file operations are confined to the intended UPLOAD_DIR. Implement authentication and least-privilege permissions for the MCP interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94044. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart