CVE-2026-81847: MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal
A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function savepipeline/loadpipeline of the file pipelinetools.py. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named c93ef45cba75295eba26d9ff1ffb9202a91c6150. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MAA-AI MaaMCPto a version that resolves this vulnerability.Fixed in 1.1.1.dev6+g2e4a41287Patch c93ef45cba75295eba26d9ff1ffb9202a91c6150
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
MAA-AI MaaMCP versions up to 1.1.1.dev6+g2e4a41287 should be considered affected based on the available information.
What level of attacker access is required?
The vulnerability is remotely reachable, but the CVSS vector indicates the attacker needs low-level privileges and user interaction is required.
Is exploitation likely to be practical?
An exploit has been made public, and the CVSS vector rates exploit maturity as proof-of-concept.
What remediation is identified?
Deploy the patch identified as c93ef45cba75295eba26d9ff1ffb9202a91c6150.