Path Traversal in Lharries Whatsapp-Mcp
CVE-2026-10264
A vulnerability was determined in lharries whatsapp-mcp 0.0.1. Affected by this vulnerability is the function SendMessageRequest of the file whatsapp-bridge/main.go of the component Send API Endpoint. This manipulation of the argument mediaPath causes path traversal. The exploit has been publicly disclosed and may be utilized. Patch name: 6657cdceadd361e8fbe824afe9d00b4504009a5d. It is recommended to apply a patch to fix this issue.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (16.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 17th percentile — 16.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Lharries Whatsapp-Mcp — versions 0.0.1
Weakness classification (CWE)
References
- vuldb.com/vuln/367544 (technical-description, vdb-entry)
- vuldb.com/vuln/367544/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-10264 (third-party-advisory)
- vuldb.com/submit/824924 (third-party-advisory)
- github.com/lharries/whatsapp-mcp/issues/241 (issue-tracking, exploit)
- github.com/BenGedi/whatsapp-mcp/pull/1 (issue-tracking, patch)
- github.com/BenGedi/whatsapp-mcp/commit/6657cdceadd361e8fbe824afe9d00b4504009a5d (patch)
- github.com/lharries/whatsapp-mcp/ (product)
Frequently asked questions
- What is CVE-2026-10264?
- CVE-2026-10264 is a low-severity vulnerability in Lharries Whatsapp-Mcp, classified under Path Traversal. CVSS score: 3.5/10. Published 2026-06-01.
- How severe is CVE-2026-10264?
- Low severity. CVSS v3 base score is 3.5 out of 10.