CVE-2026-94044

HIGH 7.3

03-lovepreetSingh MCP route.ts create_file path traversal

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function create_file of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-22
Vendor	03-lovepreetsingh
Product	mcp
Published	Sep 20, 2026

Stay Ahead of the Next One

Get instant alerts for 03-lovepreetsingh mcp

Be the first to know when new high vulnerabilities affecting 03-lovepreetsingh mcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

03-lovepreetSingh / MCP

f95d035c5317fad81af9828286631053ccb23546

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/407973 vuldb.com: https://vuldb.com/vuln/407973/cti vuldb.com: https://vuldb.com/cve/CVE-2026-94044 vuldb.com: https://vuldb.com/submit/949284 github.com: https://github.com/03-lovepreetSingh/MCP/issues/3 github.com: https://github.com/03-lovepreetSingh/MCP/

Credits

🔍 Xh1Xxhg (VulDB User) VulDB CNA Team