This vulnerability exists in the IncomeStreamSurfer roo-code-memory-bank-mcp-server component, specifically in the readMemoryBankFile and appendMemoryBankEntry functions within src/index.ts. Manipulation of the file_name argument leads to a path traversal condition, allowing an attacker with local access and limited privileges to potentially access or modify files outside the intended directory. The product's rolling release model means version identifiers for affected or fixed releases are not provided. The vendor has been informed but has not yet responded or provided a fix. The CVSS 4.0 score is 4.8, indicating medium severity, with attack vector local and low complexity.

The vulnerability allows a local attacker with limited privileges to perform path traversal by manipulating the file_name argument in specific functions. This could lead to unauthorized access or modification of files outside the intended directory scope. There is no evidence of known exploits in the wild. The impact is limited by the requirement for local access and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted users only and monitor for any updates from the vendor. No official fix or temporary workaround is currently available.