CVE-2026-79743: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-79743 is a path traversal vulnerability (CWE-22) in MCPHub, a unified hub for managing and orchestrating MCP servers and APIs. The flaw exists in the MCPB File Upload Handler, where the name field from an uploaded archive's manifest.json is directly concatenated into a file system path without sanitization, enabling an attacker to write files or create directories at arbitrary locations on the server. All MCPHub versions prior to 0.12.13 are affected. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly). The vulnerability was published on August 31, 2026, and patched in version 0.12.13 (MCPHub Release).

The root cause is improper input validation (CWE-22) in src/controllers/mcpbController.ts. At line 107, manifest.name is read from manifest.json inside a user-uploaded .mcpb archive and directly interpolated into a path.join() call to construct finalExtractDir (e.g., path.join(path.dirname(mcpbFilePath), 'server-' + manifest.name)), with no call to path.basename(), path.resolve(), or any allow-list check (GitHub Advisory). The only validation performed is a non-empty check on manifest.name. The upload endpoint (POST /mcpb/upload) uses multer middleware that only validates file extension (.mcpb) and size, leaving archive contents entirely attacker-controlled. Additionally, the cleanupOldMcpbServer function at line 110 uses the same unsanitized manifest.name to construct deletion paths, though its impact is partially mitigated because deletion is scoped to entries returned by readdirSync on the upload directory (GitHub Advisory).

A remote, unauthenticated attacker can craft a malicious .mcpb file with a manifest.name value such as ../../../etc/malicious to cause the server to extract files or create directories at arbitrary locations on the file system via fs.mkdirSync and fs.renameSync. This primarily affects integrity — an attacker could overwrite configuration files, plant malicious scripts, or corrupt application data — with potential for escalation to remote code execution if writable paths include executable locations or startup scripts (GitHub Advisory). Confidentiality impact is assessed as low/none in the CVSS scoring, but the ability to write arbitrary files to the server represents a significant integrity and availability risk.

The NVD SSVC assessment classifies this vulnerability as automatable with a PoC exploitation status, indicating that proof-of-concept exploit code or techniques are publicly known (Feedly). No privileges or user interaction are required to exploit the /mcpb/upload endpoint, lowering the barrier for exploitation significantly. The EPSS score is reported as 0.0, suggesting low current probability of widespread exploitation, and the vulnerability does not appear in the CISA KEV catalog. No specific threat actor attribution or confirmed in-the-wild exploitation has been reported at this time.

1. Reconnaissance: Identify internet-facing MCPHub instances running versions prior to 0.12.13 using network scanning tools (e.g., Shodan, Censys) or by checking the MCPHub version endpoint.
2. Craft malicious MCPB archive: Create a ZIP archive containing a manifest.json with the name field set to a path traversal string, e.g., "name": "../../../tmp/pwned". Include any payload files (e.g., a web shell or malicious script) in the archive.
3. Rename archive: Save the ZIP file with a .mcpb extension to satisfy the upload middleware's file extension filter.
4. Upload the malicious file: Send an HTTP POST request to the /mcpb/upload endpoint with the crafted .mcpb file as the mcpbFile multipart form field:

   POST /mcpb/upload HTTP/1.1
   Content-Type: multipart/form-data; boundary=...
   [multipart body with malicious .mcpb file]

5. Trigger path traversal: The server extracts the archive, reads manifest.json, and constructs finalExtractDir as path.join(..., 'server-../../../tmp/pwned'), resolving to an attacker-controlled path outside the intended upload directory.
6. Achieve objective: Files from the archive are moved to the traversed path via fs.renameSync, potentially overwriting sensitive files or planting malicious content at arbitrary server locations (GitHub Advisory).

• Network: Unexpected HTTP POST requests to /mcpb/upload from unknown or external IP addresses, especially with large or unusual payloads; repeated upload attempts with varying filenames.
• File System: Presence of directories or files outside the expected data/uploads/mcpb/ directory tree with names matching server- prefixed patterns; unexpected files in sensitive directories (e.g., /etc/, /tmp/, application root) with recent modification timestamps.
• Logs: Web server or application access logs showing POST requests to /mcpb/upload followed by file system errors or unexpected directory creation events; Node.js process logs indicating fs.mkdirSync or fs.renameSync operations on paths outside the upload directory.
• Process: Unexpected child processes spawned by the MCPHub Node.js process if a planted script is subsequently executed.

Upgrade MCPHub to version 0.12.13 or later, which patches this vulnerability (MCPHub Release). The recommended code-level fix is to apply path.basename() to strip directory components from manifest.name, enforce a strict character allow-list (alphanumeric, _, -, .), and validate the resolved path against the intended base directory using path.resolve() with a startsWith() check before any file system operations (GitHub Advisory). As a temporary workaround where upgrading is not immediately possible, restrict network access to the /mcpb/upload endpoint to trusted, authenticated users only via firewall rules or reverse proxy access controls.

The vulnerability was credited to researcher keyblues and published as a GitHub Security Advisory (GHSA-p3h2-2j4p-p83g) by the MCPHub maintainer samanhappy (GitHub Advisory). The fix was included in a broader security hardening pull request (#770) that also addressed several other advisories related to authentication and authorization issues in MCPHub (GitHub PR). No significant broader media coverage or notable community commentary beyond the advisory itself has been identified.