CVE-2026-15522

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15522

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15522.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15522

Published

2026-07-13T01:45:11.320Z

Modified

2026-07-16T03:31:12.717426978Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

tugcantopaloglu godot-mcp run_project index.js validatePath path traversal

Details

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component run_project. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.0.0 addresses this issue. The patch is identified as eb63add552aa4bd9205395cf91b40654654a3cf2. It is suggested to upgrade the affected component.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15522.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/tugcantopaloglu/godot-mcp

Affected ranges

Type

GIT

Repo

https://github.com/tugcantopaloglu/godot-mcp

Events

Introduced

fd913546468ab53a23c51be6be90e6cdac28e50c

Fixed

eb63add552aa4bd9205395cf91b40654654a3cf2

Fixed

df85eec737e4b0d67733cba989a8f764a7ab5dfb

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.0.0

v2.*

v2.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15522.json"