CVE-2026-10264
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A path traversal vulnerability was found in lharries whatsapp-mcp 0.0.1 in the SendMessageRequest function in whatsapp-bridge/main.go. The attack can be performed remotely and the exploit is public. A patch is available.
Risk Assessment
An attacker could read arbitrary files on the server, leading to leakage of sensitive data.
Recommendation
Apply the patch with ID 6657cdceadd361e8fbe824afe9d00b4504009a5d immediately.
Original NVD description (English source)
A vulnerability was determined in lharries whatsapp-mcp 0.0.1. Affected by this vulnerability is the function SendMessageRequest of the file whatsapp-bridge/main.go of the component Send API Endpoint. This manipulation of the argument mediaPath causes path traversal. The exploit has been publicly disclosed and may be utilized. Patch name: 6657cdceadd361e8fbe824afe9d00b4504009a5d. It is recommended to apply a patch to fix this issue.