CVE-2026-94044: MCP Path Traversal Vulnerability

CVE-2026-94044 Overview

CVE-2026-94044 is a path traversal vulnerability [CWE-22] in the 03-lovepreetSingh MCP project up to commit f95d035c5317fad81af9828286631053ccb23546. The flaw resides in the create_file function of app/api/mcp/route.ts. Attackers can manipulate the filePath and content arguments to write files outside the intended directory. The attack is remotely exploitable without authentication or user interaction. A public exploit is available, increasing the likelihood of opportunistic abuse. The project does not use versioning, so no fixed release is currently identified. The maintainer was notified through a GitHub issue but has not yet responded.

Critical Impact
Remote unauthenticated attackers can write arbitrary files to locations outside the intended directory, potentially overwriting application code or configuration served by the Model Context Protocol (MCP) endpoint.

Affected Products

03-lovepreetSingh MCP repository up to commit f95d035c5317fad81af9828286631053ccb23546
Vulnerable component: app/api/mcp/route.ts
No versioned releases are published for this project

Discovery Timeline

2026-09-20 - CVE-2026-94044 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in the NVD database

Technical Details for CVE-2026-94044

Vulnerability Analysis

The vulnerability affects the create_file handler exposed by the MCP HTTP route in app/api/mcp/route.ts. The handler accepts caller-supplied filePath and content parameters and uses them to create a file on disk. Because the input is not normalized or constrained to a permitted base directory, an attacker can supply relative traversal sequences such as ../ to escape the intended directory. The request is processed over the network, requires no authentication, and executes with the privileges of the Node.js process hosting the MCP server. Successful exploitation results in arbitrary file write, which can be used to plant malicious source files, overwrite configuration, or clobber runtime assets served by the application.

Root Cause

The root cause is missing input validation on the filePath parameter passed to create_file. The function trusts caller-controlled path input and does not enforce canonicalization or a startsWith check against an allowed base directory. This maps to the CWE-22 pattern for improper limitation of a pathname to a restricted directory.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the MCP route with a filePath value containing traversal sequences and arbitrary content. The server writes the attacker-controlled content to the resolved path, which may lie anywhere the process user has write access. See the VulDB CVE Report and the GitHub Issue Tracker for technical details.

No verified proof-of-concept code is reproduced here. Refer to the linked references for exploitation specifics.

Detection Methods for CVE-2026-94044

Indicators of Compromise

HTTP requests to the /api/mcp route containing filePath values with ../, ..\\, URL-encoded traversal (%2e%2e%2f), or absolute paths outside the project working directory
Unexpected files appearing outside the application's designated content directory, particularly under system paths, home directories, or web-served static folders
Modifications to .ts, .js, .json, or .env files that do not correspond to a deployment or commit
Node.js process file-write telemetry originating from the MCP route handler targeting unusual destinations

Detection Strategies

Inspect application logs for POST/PUT requests to MCP endpoints and alert when filePath parameters contain traversal sequences or absolute paths
Enable filesystem auditing (auditd on Linux, Sysmon FileCreate on Windows) on the host running the MCP server and correlate writes with the Node.js process
Add a code-level guard that logs any resolved path outside the allowed base directory before the request is processed

Monitoring Recommendations

Baseline the directories the MCP process legitimately writes to and alert on any write outside that set
Forward web server and Node.js application logs to a central analytics platform and build a detection for path-traversal token patterns in request bodies
Monitor GitHub issue #3 and the project repository for a maintainer response or patch commit

How to Mitigate CVE-2026-94044

Immediate Actions Required

Take the MCP endpoint offline or restrict it to trusted networks until the maintainer publishes a fix
Run the Node.js process as an unprivileged user with write access limited to a dedicated content directory
Deploy a reverse proxy or WAF rule that rejects requests to /api/mcp containing .., encoded traversal sequences, or absolute paths in JSON bodies
Audit the filesystem for files written since the endpoint was exposed and review for unauthorized content

Patch Information

No vendor patch is available at the time of publication. The project does not use versioning, and the maintainer has not responded to the disclosure issue. Track the GitHub repository and the VulDB entry for updates.

Workarounds

Modify create_file in app/api/mcp/route.ts to resolve the target path with path.resolve and reject any result that does not begin with the intended base directory
Replace caller-supplied filenames with server-generated identifiers and store user content under a fixed directory
Run the MCP server inside a container with a read-only root filesystem and a single writable volume scoped to the content directory
Require authentication and rate limiting on the MCP route to reduce unauthenticated exposure

bash

# Example reverse-proxy guard (nginx) to block traversal payloads on the MCP route
location /api/mcp {
    if ($request_body ~* "(\.\./|\.\.\\\\|%2e%2e%2f|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://mcp_upstream;
}