This vulnerability in NocteDefensor LudusMCP (up to version 1.0.24) allows an attacker with local access to manipulate the guide_name argument in a function within src/tools/ludusEnvironmentGuidesSearch.ts, leading to path traversal. This could potentially allow unauthorized access to files outside the intended directory structure. The issue was reported early to the project, but no remediation or patch has been released to date.

An attacker with local access can exploit this vulnerability to perform path traversal, potentially accessing or manipulating files outside the intended scope. This could lead to unauthorized information disclosure or modification of files on the affected system. The impact is limited by the requirement for local access and the lack of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted users only and monitor for any suspicious activity related to the affected component until an official patch is available.