This vulnerability in abrinsmead mindpilot-mcp 0.5.0 involves a path traversal flaw in the HistoryService component. An attacker with local access and limited privileges can manipulate the argument ID to traverse directories and potentially access unauthorized files. The project has been informed but has not issued a fix or official response. No known exploits are reported in the wild.

An attacker with local access and limited privileges can exploit this vulnerability to perform path traversal, potentially accessing files outside the intended directory scope. The impact is limited by the requirement for local access and the medium severity rating. There is no indication of remote exploitation or privilege escalation beyond local user capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should restrict local access to trusted users only and monitor for updates from the vendor.