Vulnerability · Published Jul 13, 2026 · Assigned by VulDB

CVE-2026-15522tugcantopaloglu godot-mcp run_project index.js validatePath path traversal

Medium 5.3

In plain English

A medium-severity path traversal in godot-mcp from tugcantopaloglu. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 93.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component run_project. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.0.0 addresses this issue. The patch is identified as eb63add552aa4bd9205395cf91b40654654a3cf2. It is suggested to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
tugcantopaloglu	godot-mcp	2.0.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-377851 | tugcantopaloglu godot-mcp run_project index.js validatePath path traversal vdb-entry, technical-description
VDB-377851 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-15522 | CVE Analysis and Report third-party-advisory
Submit #854523 | tugcantopaloglu godot-mcp 2.0.0 Path Traversal third-party-advisory
https://github.com/tugcantopaloglu/godot-mcp/issues/9 exploit, issue-tracking
https://github.com/tugcantopaloglu/godot-mcp/commit/eb63add552aa4bd9205395cf91b40654654a3cf2 patch
https://github.com/tugcantopaloglu/godot-mcp/releases/tag/v3.0.0 patch
https://github.com/tugcantopaloglu/godot-mcp/ product