3

An arbitrary file write vulnerability (CWE-22) has been identified in the create_file MCP tool of 03-lovepreetSingh MCP, commit f95d035c5317fad81af9828286631053ccb23546 . The tool accepts attacker-controlled filePath and content arguments and joins the supplied path with the intended uploads directory without verifying that the resolved destination remains within that directory. An attacker with access to the MCP interface can use path traversal sequences to create or overwrite arbitrary files writable by the server process, potentially causing source or configuration corruption, service disruption, or further compromise. A working exploit has been demonstrated by writing attacker-controlled content outside the uploads directory. This product does not use versioning, so affected and unaffected release information is unavailable, and no fixed version is known at the time of reporting.

CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Suggested Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Suggested Base Score: 9.1 (Critical)

Affected component(s): app/api/mcp/route.ts

MCP Tool: create_file

Data flow: Source: app/api/mcp/route.ts:101 ( { fileP ... ntent } → filePath ) Source code: async ({ filePath, content }) => { Propagation: app/api/mcp/route.ts:104 ( const fullPath = path.join(UPLOAD_DIR, filePath) ) Sink: app/api/mcp/route.ts:109 ( fullPath ) Sink code: await fs.writeFile(fullPath, content, "utf-8")

Source: app/api/mcp/route.ts:101 ( { fileP ... ntent } → filePath )

Source code: async ({ filePath, content }) => {

Propagation: app/api/mcp/route.ts:104 ( const fullPath = path.join(UPLOAD_DIR, filePath) )

Sink: app/api/mcp/route.ts:109 ( fullPath )

Sink code: await fs.writeFile(fullPath, content, "utf-8")

Version: None , commit f95d035c5317fad81af9828286631053ccb23546

Start the affected server with MCP Inspector

Click List Tools and select the create_file tool. Click Run Tool to send the request with the following arguments:

Validation MCP Inspector returns Tool Result: Success and reports that ../../../tmp/poc1.txt was created successfully. Reading the resulting file from the terminal returns Arbitrary File Write Success , confirming that attacker-controlled path traversal escapes the intended uploads directory and writes attacker-controlled content to a filesystem location accessible to the server process.

Resolve UPLOAD_DIR and the requested destination to canonical absolute paths before any filesystem operation, reject absolute paths and traversal segments, and use path.relative() to ensure the destination remains strictly within UPLOAD_DIR . Canonicalize existing parent directories with realpath and reject symbolic-link paths that escape the allowed root.

Restrict file names, extensions, and content size; use exclusive creation such as flag: "wx" when overwriting is not intended; require authentication and authorization for filesystem tools; run the service with least-privilege filesystem permissions; and add regression tests covering .. traversal, absolute paths, sibling-prefix paths, overwrite attempts, and symbolic-link escapes.

This vulnerability is reported through responsible disclosure.

The reporter requests CVE ID assignment through VulDB, an authorized CVE Numbering Authority (CNA), if the vulnerability meets CVE assignment requirements.

Repository:

CWE-22:

For further information, please refer to Xh1Xxhg/public_exp#5