CVE-2026-8116

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-8116

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8116.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-8116

Published

2026-05-07T23:30:11.843Z

Modified

2026-07-15T01:48:50.039998686Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

huangjunsen0406 xiaozhi-mcphub dxtController.ts path traversal

Details

A weakness has been identified in huangjunsen0406 xiaozhi-mcphub up to 1.0.3. This vulnerability affects unknown code of the file src/controllers/dxtController.ts. This manipulation of the argument manifest.name causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8116.json"
}

References

Affected packages

Git / github.com/huangjunsen0406/xiaozhi-mcphub

Affected ranges

Type

GIT

Repo

https://github.com/huangjunsen0406/xiaozhi-mcphub

Events

Introduced

c5dbcfe532722a19fa82703be6cf5e64519efd72

Last affected

7ed7fddaf94e9690a4bd61f0db45aff8ec269e87

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "introduced": "1.0.1"
        },
        {
            "last_affected": "1.0.1"
        },
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2"
        },
        {
            "introduced": "1.0.3"
        },
        {
            "last_affected": "1.0.3"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8116.json"