This vulnerability in PV-Bhat gemsuite-mcp 1.0.0 involves improper handling of the file_path/file_paths arguments in the src/handlers/unified-gemini.ts file, enabling a local attacker to perform path traversal (CWE-22). The issue affects components gemini_search, gemini_reason, gemini_process, and gemini_analyze. The attack requires local access with low privileges and does not require user interaction. The project was notified early but has not issued a response or fix. The CVSS v3.1 base score is 3.3, indicating a low to medium severity impact primarily on confidentiality.

The vulnerability allows a local attacker with low privileges to read files outside the intended directory by manipulating file path arguments, potentially exposing sensitive information. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released and the vendor has not responded, users should restrict local access to trusted users only and monitor for updates from the vendor or project maintainers.