CVE-2026-79743

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 0.12.13

Description The MCPB File Upload Handler extracts a ZIP file and reads a manifest.json file from it. The name field within this manifest is concatenated into a file path without sanitization or path traversal character validation. This allows an attacker to craft a malicious MCPB file with a name value such as ../../../etc/malicious, leading to files being extracted to arbitrary locations on the file system. Additionally, the cleanupOldMcpbServer() function uses this unsanitized name field, which could potentially allow the deletion of arbitrary directories. The issue is accessible via the /mcpb/upload endpoint.

Recommendations Update to version 0.12.13. As a temporary mitigation, restrict access to the /mcpb/upload endpoint or avoid uploading MCPB files from untrusted sources.