CVE-2026-66004

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method. By injecting traversal sequences in API response include keys, an attacker can write arbitrary files (e.g., ../../.bashrc), enabling overwrite of sensitive files and potentially persis...