CVE-2026-66004: BlenderMCP Path Traversal Vulnerability

CVE-2026-66004 Overview

CVE-2026-66004 is a path traversal vulnerability [CWE-22] in BlenderMCP, a Model Context Protocol (MCP) server that connects Blender to AI assistants. The flaw resides in the download_polyhaven_asset method, which trusts include keys returned by the Poly Haven API without validating their paths. An attacker able to influence the API response, either through a man-in-the-middle (MITM) position or prompt injection, can supply traversal sequences such as ../../.bashrc to write arbitrary files outside the intended temporary directory. Successful exploitation enables overwriting sensitive user files and achieving persistent code execution. The issue is fixed in commit 30a3308.

Critical Impact
Attackers can overwrite files like ~/.bashrc or authorized_keys to gain persistent code execution on hosts running vulnerable BlenderMCP versions.

Affected Products

BlenderMCP (ahujasid/blender-mcp) versions before commit 30a3308
Deployments exposing download_polyhaven_asset to untrusted API responses
Any MCP-integrated Blender environment accepting external Poly Haven asset metadata

Discovery Timeline

2026-07-24 - CVE-2026-66004 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66004

Vulnerability Analysis

BlenderMCP's download_polyhaven_asset handler retrieves asset metadata from a remote API and iterates over an includes dictionary. Each entry contains a url and a filesystem include_path key. The vulnerable code joins include_path directly to a temporary directory using os.path.join(temp_dir, include_path). Because os.path.join returns the second argument when it is absolute and does not strip .. segments, an attacker-controlled include_path escapes temp_dir and lands anywhere the process can write.

The writable surface includes shell startup files, SSH authorized_keys, cron entries, and application configuration. Because BlenderMCP typically runs under the user's account, arbitrary writes translate into persistent code execution on next shell login or service invocation.

Root Cause

The root cause is missing validation of attacker-influenceable filesystem paths supplied by an external API. The code assumes the Poly Haven response is trustworthy and does not enforce that resolved paths remain inside temp_dir. The download_sketchfab_model method already implemented a zip-slip check, but the equivalent guard was absent here.

Attack Vector

Exploitation requires the attacker to control the JSON response to the asset lookup. Two realistic paths exist. First, a MITM attacker on the network between the host and the Poly Haven API can rewrite include_path values. Second, an attacker using prompt injection against the AI assistant driving BlenderMCP can steer it toward a malicious asset endpoint. User interaction is required to trigger the download, which is reflected in the CVSS UI:P metric.

python

                                 # Get the URL for the included file - this is the fix
                                 include_url = include_info["url"]
 
+                                # Validate include_path — the API response controls these
+                                # dict keys; a malicious or MITM'd response could request an
+                                # absolute path or one containing ".." to escape temp_dir
+                                # and write arbitrary files (e.g. ~/.bashrc, authorized_keys).
+                                # Mirrors the zip-slip check in download_sketchfab_model.
+                                target_path = os.path.join(temp_dir, os.path.normpath(include_path))
+                                abs_temp_dir = os.path.abspath(temp_dir)
+                                abs_target_path = os.path.abspath(target_path)
+                                if (os.path.isabs(include_path)
+                                        or ".." in include_path
+                                        or not abs_target_path.startswith(abs_temp_dir + os.sep)):
+                                    print(f"Skipping include with unsafe path: {include_path}")
+                                    continue
+
                                 # Create the directory structure for the included file
-                                include_file_path = os.path.join(temp_dir, include_path)
+                                include_file_path = target_path
                                 os.makedirs(os.path.dirname(include_file_path), exist_ok=True)

                                 # Download the included file

Source: BlenderMCP security patch commit 30a3308

Detection Methods for CVE-2026-66004

Indicators of Compromise

Unexpected modifications to shell startup files such as ~/.bashrc, ~/.zshrc, or ~/.profile on hosts running BlenderMCP
New or altered entries in ~/.ssh/authorized_keys created by the Blender or Python process
File writes by the BlenderMCP Python process to paths outside its designated temp_dir
Outbound HTTP traffic to non-official Poly Haven endpoints during asset downloads

Detection Strategies

Monitor process file-write telemetry from the BlenderMCP Python interpreter and alert on writes traversing above the temp directory
Inspect BlenderMCP logs for the patched message Skipping include with unsafe path: after upgrading, indicating attempted exploitation
Perform TLS inspection or certificate pinning validation on connections to Poly Haven APIs to detect MITM tampering

Monitoring Recommendations

Track integrity of user-level persistence files (.bashrc, .profile, authorized_keys, cron tables) on developer and artist workstations
Log all MCP tool invocations, including asset identifiers and target directories, for post-incident correlation
Alert on Python child processes spawned from Blender that write to home-directory dotfiles

How to Mitigate CVE-2026-66004

Immediate Actions Required

Upgrade BlenderMCP to a build that includes commit 30a3308 or later
Audit hosts running vulnerable BlenderMCP for unexpected changes to shell startup files and SSH authorized keys
Restrict BlenderMCP to trusted asset sources and enforce HTTPS with certificate validation for the Poly Haven API

Patch Information

The fix is available in the BlenderMCP repository commit 30a3308446cd8f81a9446e5a2ed657c0d8d86072, merged via pull request #258. The patch normalizes include_path, rejects absolute paths and .. segments, and verifies the resolved absolute path stays within temp_dir. See the VulnCheck advisory and GitHub issue #257 for background.

Workarounds

Run BlenderMCP inside a container or sandbox with a read-only home directory to contain arbitrary writes
Disable the download_polyhaven_asset tool exposure in the MCP server configuration until patched
Route asset API traffic through a proxy that validates response schemas and rejects include_path values containing .. or absolute paths

bash

# Verify the installed BlenderMCP includes the fix commit
cd blender-mcp
git log --oneline | grep 30a3308 || echo "VULNERABLE: patch commit not present"

# Pull and check out the fixed revision
git fetch origin
git checkout 30a3308446cd8f81a9446e5a2ed657c0d8d86072