PT-2026-36546 · Flux159 · Mcp-Game-Asset-Gen

Eternity · Published 2026-05-01 · Updated 2026-05-05 · CVE-2026-7594

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Flux159 mcp-game-asset-gen version 0.1.0

Description A path traversal issue exists in the MCP Interface component within the image to 3d async() function of the src/index.ts file. This flaw allows remote attackers to perform path traversal by manipulating the statusFile argument.

Recommendations As a temporary workaround, restrict the use of the image to 3d async() function or carefully validate the statusFile argument to prevent unauthorized file system access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7594

Affected Products

Mcp-Game-Asset-Gen

References · 9

• 🔥 https://github.com/Flux159/mcp-game-asset-gen/issues/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7594 · Security Note
• https://vuldb.com/submit/805508 · Note
• https://twitter.com/VulmonFeeds/status/2050392088752066584 · Twitter Post
• https://t.me/CVEtracker/52469 · Telegram Post
• https://vuldb.com/vuln/360547/cti · Note
• https://github.com/Flux159/mcp-game-asset-gen · Note
• https://vuldb.com/vuln/360547 · Note
• https://t.me/cveNotify/162242 · Telegram Post