Attack Chain

1. The attacker identifies a vulnerable instance of mcp-game-asset-gen 0.1.0 running on a remote server.
2. The attacker crafts a malicious HTTP request targeting the image_to_3d_async function.
3. Within the request, the attacker manipulates the statusFile argument to include path traversal sequences (e.g., “../”).
4. The server-side application processes the request, using the attacker-controlled statusFile value to construct a file path.
5. Due to insufficient input validation, the path traversal sequences are not properly sanitized.
6. The application attempts to read or write to a file outside the intended directory, based on the manipulated path.
7. If successful, the attacker gains unauthorized access to sensitive files or overwrites critical system files.
8. The attacker leverages the file access to further compromise the system, potentially leading to code execution or data exfiltration.

Impact

Successful exploitation of this path traversal vulnerability could allow attackers to read sensitive files, overwrite critical system files, or even achieve remote code execution on the affected server. This could lead to data breaches, system instability, or complete server compromise. Given the availability of public exploits, organizations using mcp-game-asset-gen 0.1.0 are at immediate risk.

Recommendation

• Apply input validation and sanitization to the statusFile argument within the image_to_3d_async function to prevent path traversal, addressing CVE-2026-7594.
• Monitor web server logs for suspicious requests containing path traversal sequences (e.g., “../”) in the statusFile parameter using the provided Sigma rule.
• Implement the Sigma rule targeting process creation events related to the exploitation of CVE-2026-7594.