← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-x9vx-8c8r-c57x: Unvalidated username Parameter Path Traversal in getUserByUsername() (Infomaniak/mcp-server-kchat)

[PATCHED UPSTREAM IN v1.1.1 • PR #70 MERGED (COMMIT 5ed2728f5a)]
Privately reported to Infomaniak/mcp-server-kchat via GitHub Private Vulnerability Reporting (GHSA-x9vx-8c8r-c57x) covering unencoded username interpolation into /users/username/${username} in getUserByUsername() (src/kchat-client.ts & src/index.ts).
Confirmed and patched upstream by Infomaniak maintainer @L3o-pold in Pull Request #70 (commit 5ed2728f5a, released in v1.1.1) by enforcing USERNAME_PATTERN validation in src/index.ts and encodeURIComponent(username) in src/kchat-client.ts.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-x9vx-8c8r-c57x",
  "repository": "Infomaniak/mcp-server-kchat",
  "html_url": "https://github.com/Infomaniak/mcp-server-kchat/security/advisories/GHSA-x9vx-8c8r-c57x",
  "fix_pr": "https://github.com/Infomaniak/mcp-server-kchat/pull/70",
  "fix_commit": "https://github.com/Infomaniak/mcp-server-kchat/commit/5ed2728f5aa9d1829a3023c673bca8b6037ecbf8",
  "patched_version": "v1.1.1",
  "state": "closed (patched in v1.1.1 / PR #70)",
  "updated_at": "2026-10-29T00:30:29Z",
  "summary": "Unvalidated username Parameter Path Traversal in getUserByUsername() (src/kchat-client.ts & src/index.ts)",
  "severity": "medium",
  "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "status": "Patched Upstream in v1.1.1 (PR #70 / commit 5ed2728f5a)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-22",
    "CWE-88"
  ]
}