Path Traversal

The Akamai rule that stops running when you add .css

7 September 2026·16 mins

Research WAF Akamai AWS WAF Path Traversal CDN Bug Bounty YesWeHack Methodology

I was hunting on a private YesWeHack program and I kept hitting the same wall. Not a hardened application, a 403: 461 bytes of HTML, server: AkamaiGHost, back in forty milliseconds. Whenever I got close to something the edge ate the request before the origin saw it. Three separate leads died that way across two sessions, and after the third one I stopped treating it as bad luck.

MCP Ancestor Injection: How a .mcp.json in /tmp/ Hijacks Your Claude Code Session

3 March 2026·7 mins

Vulnerability Research Bug Bounty Mcp Claude-Code Path Traversal Vulnerability-Research Bug Bounty

Third article in my MCP security series. Claude Code’s .mcp.json discovery walks from CWD to filesystem root with no boundary check and no file ownership verification. On multi-user Linux systems, any user can drop /tmp/.mcp.json to inject MCP servers into another user’s Claude Code session. Not reported to Anthropic. Here’s why, and the full technical breakdown.

↑