This vulnerability affects the Hulupeep mcp-ui-probe component, specifically the Journey/Usage module's functions get_journey, delete_journey, analyze_journey, and usage_stats in src/journey/JourneyStorage.ts. By manipulating the journeyId or filename parameters, an attacker with local access can perform path traversal attacks, potentially accessing files outside the intended directory. The issue was reported early to the project but remains unaddressed as of the publication date.

An attacker with local access can exploit this vulnerability to traverse directories and access files outside the intended scope of the application. This may lead to unauthorized disclosure of sensitive information or modification of files accessible to the application user context. The CVSS 4.8 score indicates a medium severity impact with limited attack vector and privileges required.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should restrict local access to trusted users only and monitor for any suspicious activity involving the affected functions. Check the vendor advisory regularly for updates or patches addressing this vulnerability.