BlenderMCP Path Traversal via Poisoned PolyHaven Asset Response
First seen Jul 24, 2026 · Updated Jul 24, 2026 · CVSS 5.3
BlenderMCP's download_polyhaven_asset tool fails to sanitize file paths derived from external API response keys, allowing an attacker who controls or intercepts that response to write files anywhere on disk, including dotfiles like .bashrc. This can be triggered either via a man-in-the-middle attack on the PolyHaven API or via a prompt injection that convinces the agent to fetch a malicious asset, ultimately leading to persistent code execution on the host running the MCP server.
Technical Analysis
The vulnerability lies in how download_polyhaven_asset constructs local file paths from 'include' keys present in the third-party API response, without validating or normalizing them against a safe base directory. An attacker able to tamper with the API response (via MITM) or manipulate the agent into requesting a crafted asset (via prompt injection targeting the LLM's tool-call arguments) can embed '../' traversal sequences in the include key, causing the server to write attacker-controlled content to arbitrary filesystem locations such as shell rc files. This crosses the trust boundary between an external, untrusted data source (the asset API) and the local filesystem the MCP server has write access to, effectively turning a content-download feature into an arbitrary file write primitive. Successful exploitation yields persistent code execution the next time the victim's shell or startup scripts are invoked, and could be chained with further agent actions since the MCP server operates with the privileges of the host process.
Affected Systems
BlenderMCP; protocols: MCP
Detection Signatures
- Outbound requests to PolyHaven API returning include keys containing '../' or absolute paths
- File writes from BlenderMCP process targeting paths outside the designated asset/download directory
- Writes to sensitive dotfiles (.bashrc, .profile, .ssh/*) originating from MCP server process
- Unexpected TLS certificate anomalies on PolyHaven API connections indicating MITM
- Tool call arguments to download_polyhaven_asset containing path traversal sequences or unusual key names
Remediation Steps
- 1
Upgrade BlenderMCP
Update to the patched version at or after commit 30a3308 which addresses the path traversal issue.
- 2
Sanitize and canonicalize file paths
Validate all API-derived include/path keys against an allow-list, strip traversal sequences, and enforce that resolved paths remain within a designated download directory.
- 3
Enforce TLS and response validation
Pin certificates or validate TLS connections to the PolyHaven API to prevent MITM tampering with asset responses.
- 4
Restrict MCP server file-system privileges
Run the BlenderMCP server under a low-privilege account with a chroot or sandboxed filesystem to limit blast radius of any file write vulnerability.
- 5
Add prompt-injection safeguards
Sanitize and constrain tool arguments derived from LLM-generated requests so that user-influenced or injected content cannot control raw filesystem paths.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.