CVE-2026-15522

Publié : 13 juillet 2026

Modifié : 13 juillet 2026

Score CVSS

5.3

MEDIUM

Description détaillée

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component run_project. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.0.0 addresses this issue. The patch is identified as eb63add552aa4bd9205395cf91b40654654a3cf2. It is suggested to upgrade the affected component.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/tugcantopaloglu/godot-mcp/https://github.com/tugcantopaloglu/godot-mcp/commit/eb63add552aa4bd9205395cf91b40654654a3cf2 https://github.com/tugcantopaloglu/godot-mcp/issues/9 https://github.com/tugcantopaloglu/godot-mcp/releases/tag/v3.0.0 https://vuldb.com/cve/CVE-2026-15522 https://vuldb.com/submit/854523 https://vuldb.com/vuln/377851 https://vuldb.com/vuln/377851/cti

Dernières Vulnérabilités

CVE-2026-9492

The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bundled with the module, thereby arbitrarily reading and writing physical memory and obtaining kernel-level privileges.

VOIR DÉTAILS

CVE-2026-7162

Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected software.

VOIR DÉTAILS

CVE-2026-15553

Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload malicious files and make them available for users to download.

VOIR DÉTAILS