CVE-2026-94044: 03-lovepreetSingh MCP route.ts create_file path traversal
A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function createfile of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue can be exploited remotely and requires no privileges or user interaction. An attacker able to reach the affected MCP route may manipulate the filePath/content arguments to attempt path traversal.
Are fixed releases available?
Affected and unaffected releases cannot be identified because the project does not use versioning. The vulnerable code is reported in MCP revisions up to commit f95d035c5317fad81af9828286631053ccb23546.
How urgent is mitigation?
Public exploit information is available, and the issue is rated high severity with low attack complexity. Prioritize restricting remote access to the affected route and reviewing any use of the create_file function until a vendor response or code fix is available.
What should be investigated for possible impact?
Review requests to the MCP create_file functionality for suspicious filePath values, particularly traversal sequences that could target files outside the intended directory. Also inspect files outside the expected write location for unexpected creation or modification.