VulnSocial

CVE-2026-94044Disclosure

LOWCVSS 5.5 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function create_file of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-20); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-20: 1Mentions · 2026-10-19: 1PoC Mentioned / Linked · 2026-10-19: 1Technical Details · 2026-10-19: 109-2010-19
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-201
Disclosure1
2026-10-191
PoC1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity@HugoValters
    PoC

    CVE-2026-94044: path traversal in 03-lovepreetSingh MCP (create_file). CVSS 7.3, public exploit, no patch. Update immediately. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94044/ #03lovepreetSingh #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet announces CVE-2026-94044, a path traversal vulnerability (CVSS 7.3) in 03-lovepreetSingh MCP's create_file function, noting a public exploit is available with no patch, and directs users to update immediately via a linked CVE detail page.

    0000052
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-94044 A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function create_file of the file app/ap… https://www.cve.org/CVERecord?id=CVE-2026-94044

    Post summary

    The text announces CVE-2026-94044, specifying the affected component and function, and provides a link to the official CVE record without mentioning PoC, exploitation, or remediation.

    00000765
    58.1K followersView on X

Explore more

Back to dashboard