CVE-2026-66004

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66004
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66004.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66004
Aliases
Published
2026-07-24T14:44:48Z
Modified
2026-10-08T02:51:34Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
BlenderMCP Path Traversal via download_polyhaven_asset API
Details

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66004.json"
}
References

Affected packages

Git / github.com/ahujasid/blender-mcp

Affected ranges

Type
GIT
Repo
https://github.com/ahujasid/blender-mcp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
30a3308446cd8f81a9446e5a2ed657c0d8d86072

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66004.json"