CVE-2026-7594: Flux159 mcp-game-asset-gen Path Traversal Exploitable Remotely
The National Vulnerability Database (NVD) has detailed CVE-2026-7594, a high-severity path traversal vulnerability (CVSS 7.3) in Flux159 mcp-game-asset-gen version 0.1.0. Specifically, the image_to_3d_async function within src/index.ts of the MCP Interface component is susceptible to manipulation via the statusFile argument. This flaw allows for remote exploitation, meaning attackers can trigger the vulnerability without direct access to the system.
Critically, an exploit for CVE-2026-7594 is now public. This significantly escalates the risk, as it lowers the bar for attackers to weaponize the vulnerability. The project maintainers were reportedly informed of the issue via an early report but have not yet responded, leaving affected systems exposed to immediate threats. The vulnerability is categorized as CWE-22, a common and dangerous weakness often leading to unauthorized file access or execution.
For defenders, the public exploit code means this is no longer a theoretical risk; it’s an active threat. Any organization using Flux159 mcp-game-asset-gen 0.1.0 should assume they are a target. The lack of a vendor patch or even a response means mitigation must be handled internally, likely through network segmentation, strict access controls, or, ideally, deprecating the vulnerable component until a fix is available.
What This Means For You
- If your organization utilizes Flux159 mcp-game-asset-gen 0.1.0, you are directly exposed to a remotely exploitable path traversal vulnerability (CVE-2026-7594) with a public exploit. Immediately isolate or remove this component from internet-facing systems and conduct a thorough audit for any signs of compromise, as attackers may already be leveraging the public exploit.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-7594: Flux159 mcp-game-asset-gen Path Traversal Attempt
title: CVE-2026-7594: Flux159 mcp-game-asset-gen Path Traversal Attempt
id: scw-2026-05-01-ai-1
status: experimental
level: critical
description: |
This rule detects attempts to exploit CVE-2026-7594 in Flux159's mcp-game-asset-gen. It specifically looks for requests targeting the '/src/index.ts' file and containing the 'statusFile=' parameter, which is indicative of a path traversal attempt by manipulating the statusFile argument in the image_to_3d_async function.
author: SCW Feed Engine (AI-generated)
date: 2026-05-01
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-7594/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/src/index.ts'
cs-uri-query|contains:
- 'statusFile='
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-7594 | Vulnerability | CVE-2026-7594 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 02, 2026 at 00:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7596 — Nextlevelbuilder Ui-Ux-Pro-Max-Skill Vulnerability
CVE-2026-7596 — A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py...
CVE-2026-7595 — Nextlevelbuilder Ui-Ux-Pro-Max-Skill Vulnerability
CVE-2026-7595 — A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function _format_plugins of the file .claude/skills/ui-styling/scripts/tailwind_config_gen.py...
CVE-2026-7593: Sunwood-ai-labs Command-Executor OS Command Injection
CVE-2026-7593 — A security vulnerability has been detected in Sunwood-ai-labs command-executor-mcp-server up to 0.1.0. This impacts the function execute_command of the file src/index.ts of the...