This vulnerability exists in the processGenerateRequest function of the mcp_servers/mermaid/index.ts file within the generate_mermaid_markdown component of automateyournetwork MCPyATS versions 0.1.0 through 0.1.4. An attacker with local access and low privileges can manipulate the folder/name argument to cause path traversal, potentially accessing files outside the intended directory. The vulnerability requires local access and does not require user interaction. The CVSS 4.0 base score is 4.8, indicating medium severity. No known exploits are reported in the wild, and no official patch or remediation level has been published.

The vulnerability allows local attackers to perform path traversal by manipulating the folder/name argument, potentially leading to unauthorized access to files outside the intended directory structure. The impact is limited by the requirement for local access and low privileges. There is no indication of remote exploitation or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Restrict local access to trusted users to reduce risk until a fix is available.