CVE-2026-10264 Overview
CVE-2026-10264 is a path traversal vulnerability [CWE-22] in lharries whatsapp-mcp version 0.0.1. The flaw resides in the SendMessageRequest function within whatsapp-bridge/main.go, part of the Send API Endpoint component. An attacker on an adjacent network with low privileges can manipulate the mediaPath argument to access files outside the intended directory. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic use against exposed instances. A patch identified by commit hash 6657cdceadd361e8fbe824afe9d00b4504009a5d is available and should be applied.
Critical Impact
Authenticated attackers on an adjacent network can traverse the file system through the mediaPath parameter, exposing files outside the intended media directory served by the WhatsApp MCP bridge.
Affected Products
- lharries/whatsapp-mcp version 0.0.1
- whatsapp-bridge/main.go component (Send API Endpoint)
- Deployments running the unpatched SendMessageRequest handler
Discovery Timeline
- 2026-06-01 - CVE-2026-10264 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10264
Vulnerability Analysis
The vulnerability exists in the Send API Endpoint of the whatsapp-mcp Model Context Protocol bridge. The SendMessageRequest function in whatsapp-bridge/main.go accepts a mediaPath argument from API callers and uses it to locate media files for outgoing WhatsApp messages. The handler does not adequately canonicalize or validate the supplied path before file access.
An attacker supplies sequences such as ../ within mediaPath to escape the intended media directory. The bridge then reads files from arbitrary filesystem locations accessible to the service process. Public disclosure of the exploit lowers the barrier for opportunistic abuse against exposed deployments.
Root Cause
The root cause is missing path sanitization on user-controlled input passed to file system operations [CWE-22]. The mediaPath parameter flows directly to file reading logic without enforcing that the resolved path remains within an allowlisted base directory. The patch 6657cdceadd361e8fbe824afe9d00b4504009a5d introduces validation to constrain the path.
Attack Vector
Exploitation requires adjacent network access and low-privilege API access to the bridge. An attacker submits a crafted Send API request with a mediaPath value containing relative traversal sequences. The bridge resolves the path, opens the targeted file, and incorporates its contents into the outbound media operation. Refer to the GitHub Commit Description and VulDB CVE-2026-10264 entry for technical specifics.
Detection Methods for CVE-2026-10264
Indicators of Compromise
- API requests to the Send endpoint containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths in the mediaPath parameter.
- Access log entries showing the whatsapp-bridge process reading files outside the configured media directory.
- Unexpected outbound WhatsApp messages containing contents of system or configuration files.
Detection Strategies
- Inspect HTTP request bodies and query strings handled by SendMessageRequest for traversal patterns and unexpected absolute paths.
- Correlate file open events from the whatsapp-bridge process against the configured media directory allowlist.
- Deploy WAF or reverse-proxy rules that reject mediaPath values containing .. or non-canonical separators.
Monitoring Recommendations
- Enable verbose request logging on the WhatsApp MCP bridge and forward logs to a centralized analytics platform.
- Monitor process-level file access telemetry on hosts running whatsapp-mcp for reads outside expected directories.
- Alert on repeated 4xx or 5xx responses from the Send API endpoint that may indicate traversal probing.
How to Mitigate CVE-2026-10264
Immediate Actions Required
- Apply commit 6657cdceadd361e8fbe824afe9d00b4504009a5d from the GitHub Pull Request #1 or upgrade to a version that includes the fix.
- Restrict network reachability of the WhatsApp MCP bridge to trusted hosts only.
- Rotate any credentials or tokens that may have been accessible to the bridge process if exposure is suspected.
Patch Information
The maintainers addressed the issue in commit 6657cdceadd361e8fbe824afe9d00b4504009a5d. Review the GitHub Commit Description and tracking discussion in GitHub Issue #241 before deploying. Rebuild and redeploy the whatsapp-bridge binary after applying the patch.
Workarounds
- Run the bridge under a dedicated low-privilege account with filesystem access limited to the media directory.
- Enforce a server-side allowlist that rejects mediaPath values containing .., backslashes, or absolute path prefixes.
- Place the Send API behind authenticated reverse proxy rules that normalize and validate the mediaPath parameter before forwarding.
# Configuration example: restrict whatsapp-bridge filesystem scope with systemd
[Service]
User=whatsapp
ReadWritePaths=/var/lib/whatsapp-mcp/media
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
