CVE-2026-7594: Flux159 mcp-game-asset-gen Path Traversal

CVE-2026-7594 Overview

CVE-2026-7594 is a path traversal vulnerability [CWE-22] in Flux159 mcp-game-asset-gen version 0.1.0. The flaw resides in the image_to_3d_async function within src/index.ts of the Model Context Protocol (MCP) Interface component. Attackers can manipulate the statusFile argument to traverse directories and access files outside the intended scope. The attack is executable remotely without authentication or user interaction. A public exploit exists, and the project maintainer has not responded to the issue report at the time of disclosure.

Critical Impact
Remote attackers can read or write arbitrary files on systems running mcp-game-asset-gen 0.1.0 by abusing the statusFile parameter in the asynchronous 3D asset generation flow.

Affected Products

Flux159 mcp-game-asset-gen 0.1.0
Component: MCP Interface (src/index.ts)
Function: image_to_3d_async

Discovery Timeline

2026-05-01 - CVE-2026-7594 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7594

Vulnerability Analysis

The vulnerability exists in the image_to_3d_async function exposed through the MCP Interface in src/index.ts. This function accepts a statusFile argument that is used to track or persist the state of an asynchronous image-to-3D conversion task. The implementation does not properly validate or sanitize the statusFile value before using it for file system operations.

An attacker controlling this argument can supply traversal sequences such as ../ to escape the intended working directory. Because the MCP server accepts requests over the network, the attack vector is remote and requires no privileges or user interaction. According to the CVSS 4.0 vector, the issue results in low confidentiality, integrity, and availability impact on the vulnerable component, consistent with arbitrary file read or write within the privileges of the MCP process.

Root Cause

The root cause is missing input validation on a user-supplied file path argument [CWE-22]. The statusFile parameter is treated as a trusted filename instead of being constrained to an allow-listed directory. There is no canonicalization step to resolve and verify that the final path remains inside the expected base directory before performing read or write operations.

Attack Vector

An attacker sends a crafted MCP request that invokes image_to_3d_async with a statusFile value containing path traversal sequences. The server then resolves this path relative to the process working directory, allowing the attacker to redirect file operations to arbitrary locations on disk. Because no authentication is required and the proof of concept is public, opportunistic exploitation against exposed MCP servers is feasible.

A technical description and proof of concept are referenced in the GitHub Issue Discussion and tracked in VulDB Vulnerability #360547.

Detection Methods for CVE-2026-7594

Indicators of Compromise

MCP requests to the image_to_3d_async tool containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths in the statusFile argument.
Unexpected files created or modified outside the configured asset output directory of the mcp-game-asset-gen process.
Process activity from the Node.js runtime hosting src/index.ts writing to system or user configuration directories.

Detection Strategies

Inspect MCP server logs for image_to_3d_async invocations and alert on statusFile values that resolve outside the intended status directory after canonicalization.
Apply file integrity monitoring on the host running the MCP server to detect writes outside the expected asset output path.
Review reverse proxy or API gateway logs for requests targeting the MCP endpoint with suspicious path characters in JSON payloads.

Monitoring Recommendations

Log all parameters passed to MCP tool calls and forward them to a centralized analytics platform for path traversal pattern matching.
Monitor outbound and local file system telemetry from the Node.js process for accesses to sensitive paths such as /etc, ~/.ssh, or Windows user profile directories.
Alert on new public network exposure of MCP servers identified through asset inventory and external attack surface scans.

How to Mitigate CVE-2026-7594

Immediate Actions Required

Remove mcp-game-asset-gen 0.1.0 from production or internet-exposed environments until a fix is released.
Restrict network access to the MCP server so it is reachable only from trusted local clients.
Run the MCP process under a dedicated low-privilege user account with no access to sensitive files.

Patch Information

No vendor patch is available at the time of publication. According to the advisory, the project was informed through an issue report but has not responded. Track the upstream Flux159 mcp-game-asset-gen repository and the open issue #3 for updates and apply any released fix immediately.

Workarounds

Fork the project and apply local hardening that canonicalizes the statusFile argument and rejects any resolved path outside an allow-listed status directory.
Wrap the MCP server with a request filter that drops calls to image_to_3d_async containing .., null bytes, or absolute path prefixes.
Run the service inside a container or sandbox with a read-only root filesystem and a writable volume limited to the asset output directory.

bash

# Configuration example: run mcp-game-asset-gen in a confined container
docker run --rm \
  --read-only \
  --tmpfs /tmp \
  -v /srv/mcp-assets:/app/output:rw \
  --user 1500:1500 \
  --network internal-mcp \
  --cap-drop ALL \
  mcp-game-asset-gen:0.1.0