This vulnerability in ishayoyo excel-mcp (versions 1.0.0 to 1.0.2) allows remote attackers to perform path traversal by manipulating the filePath or outputPath arguments in a function within src/index.ts responsible for reading or writing files. This could enable attackers to access files outside the intended directory scope. The vulnerability is confirmed and publicly disclosed, but no official remediation or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability allows an attacker to traverse directories and potentially access or overwrite files outside the intended directory structure of the application. This could lead to unauthorized disclosure or modification of files on the affected system. The vulnerability is remotely exploitable without user interaction, increasing the risk of attack. However, the CVSS score of 5.3 reflects a medium impact, suggesting limited or partial impact depending on the environment and usage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing temporary mitigations such as input validation or restricting file system permissions to limit the impact of path traversal. Monitor official channels for updates or patches from the vendor.