This vulnerability in alioshr memory-bank-mcp up to versions 0.2.1 and 3.1 involves a path traversal flaw due to insufficient validation of the projectName argument in the file list-project-files-validation-factory.ts file. An attacker with local access can manipulate this argument to traverse directories, potentially accessing unauthorized files. The vulnerability has a CVSS 4.8 (medium) rating and was publicly disclosed without an official vendor response or patch available at the time of reporting.

The path traversal vulnerability allows a local attacker to manipulate file paths, potentially leading to unauthorized access to files outside the intended directory scope. This could expose sensitive information or disrupt normal application behavior. However, the attack requires local access, limiting the attack surface. No remote exploitation or privilege escalation is indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for updates from the vendor. Avoid running the affected versions in untrusted environments until a patch or official mitigation is available.