This vulnerability in lharries whatsapp-mcp 0.0.1 involves path traversal via the mediaPath argument in the SendMessageRequest function of the Send API Endpoint (whatsapp-bridge/main.go). An attacker with low privileges can manipulate this argument to traverse directories, potentially accessing unintended files. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity), with attack vector being adjacent network, low attack complexity, no user interaction, and low impact on confidentiality, integrity, and availability. A patch is available as identified by the commit hash 6657cdceadd361e8fbe824afe9d00b4504009a5d, though no official vendor advisory or remediation level is provided.

Successful exploitation of this vulnerability allows an attacker with low privileges and adjacent network access to perform path traversal attacks via the mediaPath argument. This could lead to unauthorized access to files outside the intended directory scope. The impact on confidentiality, integrity, and availability is low according to the CVSS vector. There are no known exploits in the wild at this time.

A patch identified by commit 6657cdceadd361e8fbe824afe9d00b4504009a5d is recommended to fix this vulnerability. Since no official vendor advisory or remediation level is provided, users should apply this patch promptly to mitigate the risk. Monitor the vendor's channels for any official updates or advisories. No additional mitigation guidance is available from the vendor.