CVE-2026-7417 Details
Description
A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publish_content of the file src/server/mcp.server.ts of the component MCP Interface. Performing a manipulation of the argument media_paths results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
A server-side request forgery (SSRF) vulnerability and a path traversal vulnerability have been identified in Algovate xhs-mcp version 0.8.11. The SSRF vulnerability arises in the xhs_publish_content function of the MCP Interface, where user-supplied media_paths values beginning with 'http://' or 'https://' are fetched via an unvalidated outbound request. This could allow access to internal or loopback services. The path traversal vulnerability allows attackers to supply local video paths that escape the project directory, leading to unauthorized filesystem access. Both vulnerabilities can be exploited by an attacker with access to the MCP interface, potentially allowing interaction with internal network endpoints and access to local files outside the intended workspace.
No fixed version is available at the time of reporting. However, it is recommended to disable URL-based media downloads and local media path support when the MCP server is accessible by untrusted callers. Enforcing strict URL allowlists for image hosts and blocking internal, link-local, and cloud metadata destinations after DNS resolution could also mitigate the risks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 29, 2026CISA-ADP
Assessed Apr 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Algovate/xhs-mcp/ | [email protected] | ProductSource CodeVendor |
| https://github.com/Algovate/xhs-mcp/issues/6 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/BruceJqs/public_exp/issues/21 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/submit/803991 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360154 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360154/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Algovate xhs-mcp | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | New CVE Received | [email protected] |