Skip to content
Threat Feed

Product

@Samanhappy/Mcphub ( < 0.12.13)

1 brief RSS
high advisory

MCPHub Path Traversal Vulnerability via Malicious MCPB Manifest Name

MCPHub is vulnerable to path traversal, where a malicious MCPB file with a crafted manifest.name can cause files to be extracted to arbitrary locations due to missing sanitization in the upload handler.

@samanhappy/mcphub path-traversal web-application mcphub
2r 2t