CVE-2026-66004

MEDIUM 5.3

BlenderMCP Path Traversal via download_polyhaven_asset API

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.

CWE	CWE-22
Vendor	ahujasid
Product	blender-mcp
Published	Jul 24, 2026

Stay Ahead of the Next One

Get instant alerts for ahujasid blender-mcp

Be the first to know when new medium vulnerabilities affecting ahujasid blender-mcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

ahujasid / blender-mcp

0 < 30a3308446cd8f81a9446e5a2ed657c0d8d86072

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ahujasid/blender-mcp/issues/257 github.com: https://github.com/ahujasid/blender-mcp/pull/258 github.com: https://github.com/ahujasid/blender-mcp/commit/30a3308446cd8f81a9446e5a2ed657c0d8d86072 vulncheck.com: https://www.vulncheck.com/advisories/blendermcp-path-traversal-via-download-polyhaven-asset-api

Credits

YU SUN