CVE-2026-94044

Name of the Vulnerable Software and Affected Versions 03-lovepreetSingh MCP versions up to f95d035c5317fad81af9828286631053ccb23546

Description A remote path traversal issue exists in the create file() function within the 'app/api/mcp/route.ts' file. This occurs when the filePath or content arguments are manipulated, allowing an attacker to access or create files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations As a temporary workaround, restrict the use of the create file() function in the 'app/api/mcp/route.ts' file until a fix is provided.