This vulnerability involves a path traversal flaw in the readMemoryBankFile and appendMemoryBankEntry functions of the roo-code-memory-bank-mcp-server component of IncomeStreamSurfer. By manipulating the file_name argument, an attacker with local access can traverse directories and potentially access or modify files outside the intended directory. The vulnerability is present up to commit 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. Due to the rolling release model, exact affected versions are not specified. No vendor response or patch is currently available.

An attacker with local access can exploit this vulnerability to perform path traversal, potentially reading or modifying files outside the intended scope of the application. This could lead to unauthorized access to sensitive data or modification of critical files. The impact is limited by the requirement for local access and the medium CVSS score reflects this.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should restrict local access to trusted users only and monitor for unusual activity involving file operations related to the affected functions. Avoid running the vulnerable component with elevated privileges until a patch is available.