CVE-2026-79743: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in samanhappy mcphub

The vulnerability in samanhappy mcphub involves improper limitation of a pathname to a restricted directory (CWE-22). Specifically, the MCPB File Upload Handler reads the name field from manifest.json inside an uploaded ZIP file and directly concatenates it into a file path without validating or sanitizing path traversal characters. This allows an attacker to specify paths like '../../../etc/malicious' to write files outside the intended directory. Furthermore, the cleanupOldMcpbServer function uses the same unsanitized name, potentially enabling deletion of arbitrary directories. This flaw was fixed in version 0.12.13.

An attacker can exploit this vulnerability to write files to arbitrary locations on the file system, potentially overwriting critical files or placing malicious files. The cleanup function's use of the unsanitized name may allow deletion of arbitrary directories, leading to data loss or service disruption. The CVSS score of 6.9 (medium severity) reflects the network attack vector with no privileges or user interaction required but limited impact on confidentiality and integrity.

This vulnerability has been patched in samanhappy mcphub version 0.12.13. Users should upgrade to version 0.12.13 or later to remediate this issue. No other mitigation guidance is provided or required as the fix addresses the root cause by sanitizing the input path.