This vulnerability allows an attacker with local access to manipulate the guide_name argument in the ludus_environment_guides_search component of NocteDefensor LudusMCP (up to version 1.0.24) to perform a path traversal attack. The flaw is located in an unknown function within src/tools/ludusEnvironmentGuidesSearch.ts. No official remediation or patch has been published, and the vendor has not responded to the issue report.

An attacker with local access can exploit this vulnerability to perform path traversal, potentially accessing files outside the intended directory scope. This could lead to unauthorized information disclosure or modification of files accessible to the application. The CVSS score of 4.8 indicates a medium severity impact with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted users only and monitor for any suspicious activity related to the affected component until an official patch is available.