PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10264 lharries CVE debrief

A path traversal vulnerability exists in the SendMessageRequest function within whatsapp-bridge/main.go of the whatsapp-mcp project, affecting version 0.0.1. The vulnerability is triggered through manipulation of the mediaPath argument to the Send API Endpoint, allowing an attacker to traverse the file system. The issue has been publicly disclosed and a patch is available. The CVSS 4.0 vector indicates an attack vector of adjacent network, low attack complexity, low privileges required, and no user interaction, with low confidentiality impact and no integrity or availability impact. The exploitability metric is marked as proof-of-concept.

Vendor
lharries
Product
whatsapp-mcp
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running whatsapp-mcp version 0.0.1 as an MCP (Model Context Protocol) bridge for WhatsApp integration, particularly those exposing the Send API Endpoint to network-adjacent users or untrusted clients.

Technical summary

The SendMessageRequest function in whatsapp-bridge/main.go fails to properly validate the mediaPath argument, enabling directory traversal attacks. An attacker with low privileges on an adjacent network can manipulate this parameter to access files outside the intended directory. The vulnerability is classified as CWE-22 with a LOW severity CVSS score of 2.0. A patch commit is available that should be applied to eliminate the traversal vector.

Defensive priority

low

Recommended defensive actions

  • Apply patch 6657cdceadd361e8fbe824afe9d00b4504009a5d to remediate the path traversal vulnerability in the SendMessageRequest function
  • Validate and sanitize the mediaPath input parameter to restrict file access to intended directories
  • Implement path canonicalization and reject paths containing directory traversal sequences such as '..'
  • Review file access controls on systems hosting the whatsapp-mcp bridge to limit exposure
  • Monitor for anomalous file access patterns in whatsapp-bridge/main.go logs

Evidence notes

The vulnerability was reported through VulDB and is tracked as submit ID 824924 and vuln ID 367544. The issue was assigned CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The patch commit 6657cdceadd361e8fbe824afe9d00b4504009a5d was published to a fork by BenGedi, with a pull request also referenced. The original repository is maintained by lharries. The CVE was published on 2026-06-01 and remains in 'Received' status in the NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10264 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10264

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10264 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10264

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.