Vulnerability Description
A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component MCPRouter Service. This manipulation of the argument baseUrl causes server-side request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mcphubx | Mcphub | <= 0.9.10 |
Related Weaknesses (CWE)
References
- https://github.com/August829/YU1/issues/7ExploitIssue Tracking
- https://vuldb.com/?ctiid.327044Permissions RequiredVDB Entry
- https://vuldb.com/?id.327044Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.659744Third Party AdvisoryVDB Entry
- https://github.com/August829/YU1/issues/7ExploitIssue Tracking
FAQ
What is CVE-2025-11286?
CVE-2025-11286 is a vulnerability with a CVSS score of 4.7 (MEDIUM). A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component MCPRouter Service. This manipulation of ...
How severe is CVE-2025-11286?
CVE-2025-11286 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-11286?
Check the references section above for vendor advisories and patch information. Affected products include: Mcphubx Mcphub.