CVE-2026-81847: MAA-AI MaaMCP Path Traversal Vulnerability

CVE-2026-81847 Overview

CVE-2026-81847 is a path traversal vulnerability [CWE-22] in MAA-AI MaaMCP versions up to 1.1.1.dev6+g2e4a41287. The flaw resides in the save_pipeline and load_pipeline functions within pipeline_tools.py. An authenticated remote attacker can manipulate file path inputs to read or write files outside the intended pipelines directory. A public exploit exists, and the maintainers have published a fix in commit c93ef45cba75295eba26d9ff1ffb9202a91c6150.

Critical Impact
Remote attackers with low privileges can traverse the file system to access or overwrite files outside the intended pipeline storage location, affecting confidentiality, integrity, and availability of the host.

Affected Products

MAA-AI MaaMCP up to version 1.1.1.dev6+g2e4a41287
Component: maa_mcp/pipeline_tools.py
Functions: save_pipeline and load_pipeline

Discovery Timeline

2026-08-28 - CVE-2026-81847 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-81847

Vulnerability Analysis

The vulnerability exists in the MaaMCP pipeline management tool, an MCP (Model Context Protocol) integration used with the MAA automation framework. The save_pipeline and load_pipeline functions accept a file name or path parameter that is joined to a base pipelines directory without adequate normalization or containment checks. Attackers can supply traversal sequences such as ../ or absolute paths to escape the intended directory.

Because the vulnerable functions are exposed as MCP tools over the network, exploitation requires only low privileges and user interaction to trigger the tool call. Successful exploitation allows arbitrary file read via load_pipeline and arbitrary file write via save_pipeline. Writing attacker-controlled JSON to arbitrary paths can enable configuration tampering or code execution in downstream consumers.

Root Cause

The root cause is the absence of canonical path validation when resolving pipeline file arguments against the base directory. User-supplied path components were concatenated to the pipelines directory without verifying that the resulting resolved path remained inside that directory. The patch introduces a helper named ensure_within_pipelines_dir imported from maa_mcp.paths to enforce the containment invariant.

Attack Vector

The attack is initiated remotely against the MCP endpoint exposing the pipeline tools. An attacker invokes save_pipeline or load_pipeline with a name argument containing traversal sequences (for example, ../../etc/passwd or an absolute path). The service resolves the joined path outside the pipelines directory and performs the read or write operation on the attacker-chosen target.

python

# Excerpt from the security patch in maa_mcp/pipeline_tools.py
# chore(tools): remove mpe-related functionality, resolve #32

import json
-import webbrowser
from dataclasses import dataclass, field
from datetime import datetime
from enum import Enum
from pathlib import Path
from typing import Any, List, Optional, Union

from loguru import logger
-from lzstring import LZString

from maa_mcp.core import mcp, object_registry
from maa_mcp.paths import ensure_within_pipelines_dir, get_data_dir

Source: GitHub Commit c93ef45

The patch introduces ensure_within_pipelines_dir, a helper that validates resolved paths remain confined to the pipelines directory before any read or write occurs.

Detection Methods for CVE-2026-81847

Indicators of Compromise

MCP tool invocations to save_pipeline or load_pipeline containing .., /, or \ sequences in the pipeline name argument.
Unexpected file creations or modifications outside the configured MaaMCP pipelines directory.
Access attempts to sensitive paths such as /etc/passwd, user profile directories, or application configuration files originating from the MaaMCP process.

Detection Strategies

Inspect MaaMCP application logs (loguru output) for pipeline tool calls with suspicious name arguments.
Enable file integrity monitoring on directories adjacent to and above the MaaMCP pipelines directory.
Deploy a signature or rule that matches path traversal patterns in JSON-RPC or MCP transport payloads targeting the affected functions.

Monitoring Recommendations

Monitor process file access telemetry for the MaaMCP service, alerting when reads or writes occur outside the expected data directory.
Track version strings reported by MaaMCP instances and flag any still running builds at or below 1.1.1.dev6+g2e4a41287.
Correlate MCP client identities with pipeline tool usage to identify anomalous callers.

How to Mitigate CVE-2026-81847

Immediate Actions Required

Apply the upstream fix by updating to the MaaMCP build that includes commit c93ef45cba75295eba26d9ff1ffb9202a91c6150.
Restrict network exposure of the MaaMCP MCP endpoint to trusted local clients only.
Audit the pipelines directory and adjacent locations for unauthorized files created since deployment.

Patch Information

The maintainers published the fix in commit c93ef45cba75295eba26d9ff1ffb9202a91c6150, which imports ensure_within_pipelines_dir from maa_mcp.paths and applies it to the save_pipeline and load_pipeline code paths. Reference the GitHub Commit c93ef45 and GitHub Issue #32 for the full fix and discussion. Additional context is available in the VulDB entry for CVE-2026-81847.

Workarounds

Run the MaaMCP process under a low-privilege service account with file system access limited to its data directory.
Front the MCP endpoint with an authenticating reverse proxy and drop requests whose pipeline name arguments contain .., absolute path prefixes, or URL-encoded traversal sequences.
If patching is not feasible, disable or remove the save_pipeline and load_pipeline MCP tools from the exposed toolset.

bash

# Verify the installed MaaMCP version includes the fix commit
pip show maa-mcp | grep -i version
cd /path/to/MaaMCP && git log --oneline | grep c93ef45

# Restrict pipelines directory permissions to the service user
chown -R maamcp:maamcp /var/lib/maamcp/pipelines
chmod 750 /var/lib/maamcp/pipelines