MCPHub MCPB Manifest Path Traversal (Arbitrary File Write/Delete)

Technical Analysis

The MCPB File Upload Handler extracts uploaded ZIP archives and reads the 'name' field from an embedded manifest.json, concatenating it directly into a file system path (line 107) without validating for '../' traversal sequences. A crafted manifest with name set to a traversal string (e.g., referencing parent directories and a target path) causes extracted files to be written outside the designated MCPB storage directory, potentially overwriting sensitive files or dropping executable payloads in reachable web/service paths. The cleanupOldMcpbServer function (line 110) reuses the same unsanitized name to construct deletion paths, allowing an attacker-controlled manifest to trigger deletion of arbitrary directories on the host, causing denial of service or destruction of unrelated data. The entry point is the untrusted MCPB upload feature intended for legitimate MCP server package distribution, meaning any user or automated agent with upload privileges (or tricked into installing a malicious MCP server package) can pivot from a benign-looking package management action into host-level file system compromise, crossing the boundary from MCP server orchestration into underlying infrastructure control.

Affected Systems

MCPHub; protocols: MCP

Detection Signatures

• manifest.json 'name' field containing '../' or '..\' sequences
• MCPB upload requests with unusually long or nested path-like name values
• File writes occurring outside expected MCPB extraction directory
• Unexpected deletion of directories following MCPB server cleanup operations
• Log entries showing extraction paths resolving outside the configured MCPB base directory

Remediation Steps

1. 1

   Upgrade MCPHub

   Update to version 0.12.13 or later, which patches the path traversal vulnerability in the MCPB upload handler.

2. 2

   Sanitize manifest fields

   Validate and sanitize the manifest.json 'name' field to strip path traversal characters and enforce an allowlist pattern (alphanumeric, dash, underscore) before using it in any file path construction.

3. 3

   Use canonical path validation

   After resolving extraction and cleanup paths, verify the resulting canonical path remains within the intended base directory before performing file writes or deletions.

4. 4

   Restrict upload privileges

   Limit MCPB upload capability to trusted administrators and require code/package review for third-party MCP server bundles before installation.

5. 5

   Sandbox extraction

   Run ZIP extraction and cleanup operations in a restricted, low-privilege environment or container to limit blast radius if traversal occurs.