CVE-2025-5273 affects mcp-markdownify-server versions prior to 1.0.0. The vulnerability arises from the get-markdown-file tool, which can be manipulated by an attacker to read arbitrary files on the host running the server. This is a file disclosure issue categorized under CWE-552. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality. No official patch or fix is currently documented.

An attacker can remotely cause the vulnerable server to disclose arbitrary files from the host system, potentially exposing sensitive information. This can lead to confidentiality breaches without requiring privileges or prior authentication. The vulnerability does not affect integrity or availability directly according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is documented, users should restrict access to the get-markdown-file tool and monitor usage to prevent exploitation. Avoid exposing the vulnerable versions to untrusted networks until a fix is available.