CVE-2026-66004
MEDIUMahujasid blender-mcp - BlenderMCP Path Traversal via download_polyhaven_asset API
Title source: ruleDescription
BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.
References (4)
Core 4
Core References
Patch patch
Patch Commit
https://github.com/ahujasid/blender-mcp/commit/30a3308446cd8f81a9446e5a2ed657c0d8d86072
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/blendermcp-path-traversal-via-download-polyhaven-asset-api
Exploit technical-description
exploit
issue-tracking
Researcher Disclosure
https://github.com/ahujasid/blender-mcp/issues/257
Scores
CVSS v3
5.3
EPSS
0.0029
EPSS Percentile
21.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (1)
ahujasid/blender-mcp
< 30a3308446cd8f81a9446e5a2ed657c0d8d86072
Published
Jul 24, 2026
Tracked Since
Jul 24, 2026