Vulnerability · Published May 7, 2026 · Assigned by VulDB

CVE-2026-8116huangjunsen0406 xiaozhi-mcphub dxtController.ts path traversal

Medium 6.3

In plain English

A medium-severity path traversal in xiaozhi-mcphub from huangjunsen0406. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 79.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in huangjunsen0406 xiaozhi-mcphub up to 1.0.3. This vulnerability affects unknown code of the file src/controllers/dxtController.ts. This manipulation of the argument manifest.name causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
huangjunsen0406	xiaozhi-mcphub	1.0.01.0.11.0.21.0.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-361904 | huangjunsen0406 xiaozhi-mcphub dxtController.ts path traversal vdb-entry, technical-description
VDB-361904 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #808260 | huangjunsen0406 xiaozhi-mcphub 1.0.3 Path Traversal third-party-advisory
https://github.com/huangjunsen0406/xiaozhi-mcphub/issues/29 exploit, issue-tracking
https://github.com/huangjunsen0406/xiaozhi-mcphub/ product