CVE-2026-9473 Overview
CVE-2026-9473 is a path traversal vulnerability [CWE-22] in c-rick jimeng-mcp version 1.10.0, an MCP (Model Context Protocol) server implementation. The flaw resides in the getFileContent, uploadCoverFile, generateImage, and generateVideo functions located in src/api.ts. Attackers can manipulate the filePath argument to access files outside the intended directory. The exploit has been disclosed publicly and the attack can be initiated remotely with low-privileged authentication. As of disclosure, the project maintainer has not responded to the issue report.
Critical Impact
Remote authenticated attackers can read or write arbitrary files on the host running jimeng-mcp by supplying crafted filePath values, potentially exposing sensitive data or enabling further compromise.
Affected Products
- c-rick jimeng-mcp 1.10.0
- src/api.ts module functions: getFileContent, uploadCoverFile, generateImage, generateVideo
- Any MCP client integrations relying on the affected jimeng-mcp release
Discovery Timeline
- 2026-05-25 - CVE-2026-9473 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9473
Vulnerability Analysis
The vulnerability stems from improper validation of user-supplied path input in the jimeng-mcp API layer. The affected functions in src/api.ts accept a filePath argument and use it directly to read or write files on the host filesystem. Because the implementation does not canonicalize the path or restrict it to a designated base directory, attackers can supply sequences such as ../ to escape the intended directory boundary.
The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). Although the disclosed impact components are limited in scope, the network-reachable attack surface and low complexity make exploitation straightforward once an attacker holds valid credentials.
Root Cause
The root cause is missing path sanitization in four file-handling functions. The filePath parameter flows from request input directly into filesystem operations without normalization, allow-list validation, or containment within a sandbox directory. Standard path traversal hardening practices, such as resolving the absolute path and verifying it remains within an expected root, are absent.
Attack Vector
An authenticated remote attacker sends a crafted request to the MCP server invoking one of the affected functions with a filePath containing traversal sequences. For read operations through getFileContent, the server returns contents of files outside the intended directory. For write-capable operations such as uploadCoverFile, generateImage, and generateVideo, attackers can place attacker-controlled content at arbitrary filesystem locations writable by the server process.
No verified proof-of-concept code is published in the CVE references. Technical details are tracked in the GitHub Issue Tracking and the VulDB #365454 entry.
Detection Methods for CVE-2026-9473
Indicators of Compromise
- Requests to jimeng-mcp endpoints containing ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths in the filePath parameter
- Server-side file reads or writes outside the expected media or working directory of jimeng-mcp
- Unexpected new files in sensitive directories owned by the user running the MCP server process
- Error log entries from getFileContent, uploadCoverFile, generateImage, or generateVideo referencing unusual file paths
Detection Strategies
- Inspect application logs and proxy logs for filePath values that contain traversal characters or resolve outside the configured base directory
- Apply file integrity monitoring on directories adjacent to the jimeng-mcp install path to flag writes from the server process
- Correlate authenticated MCP API activity with anomalous file access patterns on the host
Monitoring Recommendations
- Enable verbose request logging for the affected endpoints and forward to centralized logging
- Alert on any read access to high-value files (/etc/passwd, SSH keys, environment files) by the jimeng-mcp process
- Track per-account request rates to the four affected functions to identify credential abuse
How to Mitigate CVE-2026-9473
Immediate Actions Required
- Restrict network exposure of jimeng-mcp to trusted clients only, ideally behind authenticated reverse proxies or VPN segments
- Audit accounts permitted to call MCP endpoints and rotate or revoke unused credentials
- Run jimeng-mcp under a least-privileged service account with filesystem access scoped to its working directory
- Monitor the GitHub Project Repository for a maintainer response and patch release
Patch Information
No official patch is available at the time of publication. The maintainer was notified through the GitHub Issue Tracking but has not responded. Affected operators should consider applying a local fix that canonicalizes filePath with path.resolve() and verifies the resolved path begins with an allow-listed base directory before any filesystem operation in src/api.ts.
Workarounds
- Wrap jimeng-mcp behind a proxy that rejects requests containing path traversal sequences or absolute paths in the filePath field
- Apply mandatory access controls (AppArmor, SELinux) confining the server process to its intended directories
- Deploy the service inside a container with read-only mounts for the host filesystem and a dedicated writable volume for media output
- Disable or remove the affected functions from exposed routes until a fix is published
# Example: confine jimeng-mcp with a systemd unit using filesystem restrictions
[Service]
User=jimeng
Group=jimeng
WorkingDirectory=/var/lib/jimeng-mcp
ReadWritePaths=/var/lib/jimeng-mcp/media
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
