CVE-2026-7594 | Flux159 mcp-game-asset-gen 0.1.0 MCP Interface src/index.ts image_to_3d_async statusFile path traversal

A vulnerability was found in Flux159 mcp-game-asset-gen 0.1.0 and classified as critical. Affected is the function image_to_3d_async of the file src/index.ts of the component MCP Interface. The manipulation of the argument statusFile results in path traversal.

This vulnerability is identified as CVE-2026-7594. The attack can be executed remotely. Additionally, an exploit exists.

The project was informed of the problem early through an issue report but has not responded yet.