The vulnerability in bazylhorsey obsidian-mcp-server 1.0.0 involves path traversal through manipulation of the readCanvas and writeCanvas functions in the CanvasService.ts source file. This allows an attacker with local access and low privileges to potentially access or modify files outside the intended directory scope. No official patch or remediation has been announced by the vendor as of the publication date.

An attacker with local access and low privileges can exploit this vulnerability to perform path traversal, potentially reading or writing files outside the intended directories. This could lead to unauthorized data access or modification within the local system context. There is no indication of remote exploitation or elevated privileges required beyond local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted users only and monitor for any updates from the vendor regarding patches or mitigations.