CVE-2026-79743: MCPHub Path Traversal Vulnerability

CVE-2026-79743 Overview

CVE-2026-79743 is a path traversal vulnerability [CWE-22] affecting MCPHub, a unified hub for centrally managing and orchestrating multiple Model Context Protocol (MCP) servers and APIs. The flaw resides in the MCPB File Upload Handler, which extracts uploaded ZIP archives and reads manifest.json from them. The name field in the manifest is concatenated directly into a file path without sanitization or traversal character validation. An attacker can craft a malicious MCPB file with a manifest name such as ../../../etc/malicious to write files to arbitrary locations. The related cleanupOldMcpbServer function reuses the same unsanitized value, enabling deletion of arbitrary directories. Version 0.12.13 contains the fix.

Critical Impact
Unauthenticated network attackers can write and delete files at attacker-chosen filesystem paths on hosts running MCPHub prior to 0.12.13.

Affected Products

MCPHub (samanhappy/mcphub) versions prior to 0.12.13
MCPB File Upload Handler component
Deployments exposing the MCPB upload endpoint to untrusted users

Discovery Timeline

2026-08-31 - CVE-2026-79743 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-79743

Vulnerability Analysis

MCPHub accepts MCPB packages as uploaded ZIP archives. During processing, the handler unpacks the archive and parses the embedded manifest.json file. At line 107 of the affected handler, the manifest.name string is concatenated into the destination extraction path with no validation. Because ZIP extraction and manifest parsing occur before any authorization or sandboxing of the target directory, a crafted name value containing ../ sequences escapes the intended installation root.

The same tainted name value flows into cleanupOldMcpbServer at line 110. This function removes directories associated with a prior version of the server. When the value contains traversal sequences, the cleanup routine can target directories outside the MCPHub data path, resulting in arbitrary directory deletion under the privileges of the MCPHub process.

Root Cause

The root cause is missing input validation on a user-controlled path segment. The handler treats manifest.name as a trusted identifier and passes it to filesystem APIs without normalization, allow-list checks, or containment verification against the intended base directory.

Attack Vector

Exploitation requires an attacker to submit a malicious MCPB archive through the file upload interface. The attack is remote and network-reachable, and does not require authentication or user interaction on vulnerable configurations. The impact scope is limited to filesystem integrity: arbitrary file placement and directory removal within the permissions of the MCPHub runtime user.

No verified public exploit code is available at this time. Refer to the GitHub Security Advisory GHSA-p3h2-2j4p-p83g and the patch pull request #770 for the vulnerable code paths and the applied fix.

Detection Methods for CVE-2026-79743

Indicators of Compromise

MCPB archive uploads containing a manifest.json with a name field that includes ../, absolute paths, or unusual characters
Files written by the MCPHub process outside its designated extraction directory
Unexpected deletion of directories adjacent to or above the MCPHub installation path
Process events showing MCPHub invoking filesystem operations against system paths such as /etc, /var, or user home directories

Detection Strategies

Inspect uploaded MCPB archives at the application layer and reject any manifest whose name fails a strict character allow-list
Monitor filesystem telemetry for write and unlink events initiated by the MCPHub process outside its data directory
Alert on MCPHub log entries referencing extraction paths that resolve outside the configured base directory

Monitoring Recommendations

Enable audit logging on the host filesystem for the MCPHub service account and forward events to a centralized log platform
Baseline the set of directories MCPHub normally reads and writes, and alert on deviations
Retain MCPB upload artifacts for retrospective analysis when new indicators emerge

How to Mitigate CVE-2026-79743

Immediate Actions Required

Upgrade MCPHub to version 0.12.13 or later on all hosts
Restrict access to the MCPB upload endpoint to authenticated administrators until the upgrade is complete
Run the MCPHub process under a least-privilege account that cannot modify system directories
Review recent MCPB uploads and filesystem activity for evidence of exploitation

Patch Information

The maintainers released the fix in MCPHub v0.12.13. The change, tracked in pull request #770, sanitizes the manifest.name value and validates that the resulting extraction path stays within the intended base directory before writing files or invoking cleanup routines.

Workarounds

Block MCPB file uploads at a reverse proxy or web application firewall until the patched version is deployed
Enforce mandatory administrator authentication on the upload route
Confine MCPHub within a container or chroot with a read-only root filesystem outside its data volume
Pre-validate MCPB archives with an out-of-band script that inspects manifest.json and rejects traversal characters

bash

# Example: reject MCPB uploads whose manifest.name contains traversal characters
unzip -p suspicious.mcpb manifest.json \
  | jq -r '.name' \
  | grep -Eq '(^/|\.\./|\\)' && echo "REJECT: unsafe manifest name"