CVE-2026-15522 Details
Description
A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component run_project. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.0.0 addresses this issue. The patch is identified as eb63add552aa4bd9205395cf91b40654654a3cf2. It is suggested to upgrade the affected component.
A path traversal vulnerability has been identified in the Godot MCP (Model Context Protocol) server extension, specifically in version 2.0.0. The issue arises within the 'run_project' tool, where the 'projectPath' argument is not properly validated. This flaw allows unauthorized modifications to be made in any writable local directory containing a 'project.godot' file. The vulnerability can be exploited by injecting a script that establishes a TCP connection and executes GDScript code, including commands that can manipulate the Godot game engine or access the local filesystem.
Users are advised to upgrade to Godot MCP version 3.0.0, which includes a fix for this vulnerability by implementing proper path validation and allowing project injections to be tracked and managed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tugcantopaloglu/godot-mcp/ | [email protected] | Vendor |
| https://github.com/tugcantopaloglu/godot-mcp/commit/eb63add552aa4bd9205395cf91b40654654a3cf2 | [email protected] | Source CodeVendor |
| https://github.com/tugcantopaloglu/godot-mcp/issues/9 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/tugcantopaloglu/godot-mcp/releases/tag/v3.0.0 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-15522 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/854523 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/377851 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/377851/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tugcantopaloglu godot-mcp | 2.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |