A path traversal vulnerability (CVE-2026-7594) has been discovered in Flux159 mcp-game-asset-gen version 0.1.0. The vulnerability affects the image_to_3d_async function in src/index.ts of the MCP Interface component. Attackers can manipulate the statusFile argument to achieve path traversal. The attack can be executed remotely and the exploit is publicly available. The project maintainers were notified through an issue report but have not responded yet.