CVE-2026-15522: Godot-MCP Path Traversal Vulnerability

CVE-2026-15522 Overview

CVE-2026-15522 is a path traversal vulnerability [CWE-22] in tugcantopaloglu godot-mcp version 2.0.0. The flaw resides in the validatePath function within build/index.js, part of the run_project component. An attacker who manipulates the projectPath argument can traverse outside the intended directory scope. Exploitation requires local access with low privileges. The exploit code has been publicly released, increasing the likelihood of opportunistic abuse against unpatched installations. Upgrading to version 3.0.0 remediates the issue via commit eb63add552aa4bd9205395cf91b40654654a3cf2.

Critical Impact
A local attacker with low privileges can bypass path validation in validatePath to access files outside the intended projectPath scope, resulting in limited confidentiality, integrity, and availability impact.

Affected Products

tugcantopaloglu godot-mcp 2.0.0
run_project component in build/index.js
Fixed in godot-mcp 3.0.0

Discovery Timeline

2026-07-13 - CVE-2026-15522 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15522

Vulnerability Analysis

The vulnerability originates in the validatePath function inside build/index.js of the godot-mcp project, a Model Context Protocol (MCP) server designed to control the Godot 4.x engine. When the run_project component processes the projectPath argument, validatePath fails to properly canonicalize or restrict input containing directory traversal sequences such as ../. As a result, the function accepts crafted paths that resolve outside the intended project root. The attacker must have local access with authenticated low-privilege permissions on the host running the MCP server. Successful exploitation yields limited read, write, or availability impact on files reachable by the server process.

Root Cause

The root cause is insufficient input validation of the projectPath argument [CWE-22]. The validatePath routine does not normalize the supplied path or verify that the resolved path remains within an allowlisted base directory. Traversal sequences pass through validation and are subsequently used in filesystem operations by the run_project handler.

Attack Vector

A local attacker interacts with the MCP server and invokes the run_project tool with a projectPath argument containing traversal sequences. Because the MCP server exposes engine control tooling to AI-driven callers, a compromised or malicious client on the same host can supply the crafted argument. No user interaction is required. The scope of exposure is limited to what the MCP process can read or execute on disk.

text

// Patch reference from server.json (commit eb63add552aa4bd9205395cf91b40654654a3cf2)
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"name": "io.github.tugcantopaloglu/godot-mcp",
"title": "Godot MCP",
- "description": "MCP server for full Godot 4.x engine control with 165 tools for AI-driven game development",
+ "description": "MCP server for full Godot 4.x engine control with 154 tools for AI-driven game development",
"repository": {
  "url": "https://github.com/tugcantopaloglu/godot-mcp",
  "source": "github"
}

Source: GitHub Commit Details

Detection Methods for CVE-2026-15522

Indicators of Compromise

MCP request logs containing projectPath arguments with ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f.
File access by the godot-mcp process to paths outside the configured project workspace.
Presence of godot-mcp version 2.0.0 in deployed environments per the package.json or server.json manifest.

Detection Strategies

Inspect MCP server logs for run_project invocations where projectPath resolves outside the expected base directory.
Monitor Node.js process filesystem syscalls (open, readFile) referencing directories outside the sanctioned workspace.
Match installed versions of godot-mcp against the vulnerable 2.0.0 baseline using software inventory tooling.

Monitoring Recommendations

Enable verbose logging on the MCP server to capture all tool arguments for auditing.
Alert on repeated failures or anomalies in validatePath outcomes if instrumentation is added.
Track child processes spawned by godot-mcp for execution paths originating outside the project root.

How to Mitigate CVE-2026-15522

Immediate Actions Required

Upgrade tugcantopaloglu/godot-mcp from 2.0.0 to 3.0.0 or later. See the GitHub Release Note.
Restrict local access to hosts running godot-mcp to trusted users only.
Audit historical MCP tool invocations for traversal patterns in the projectPath argument.

Patch Information

The fix is delivered in godot-mcp 3.0.0 via commit eb63add552aa4bd9205395cf91b40654654a3cf2. See the GitHub Commit Details and the GitHub Issue Tracker for the associated discussion.

Workarounds

Run the MCP server under a dedicated, low-privilege user account with filesystem access limited to the intended project directory.
Apply operating system level sandboxing such as chroot, containers, or AppArmor profiles to constrain filesystem reachability.
Filter or reject MCP requests where projectPath contains traversal sequences before they reach the server.

bash

# Upgrade to the patched release
npm install godot-mcp@3.0.0

# Verify installed version
npm ls godot-mcp