This vulnerability affects Ichigo3766 image-gen-mcp 0.1.0 in the upscale_images component's src/index.ts file. An attacker with local access can manipulate the output_path argument to perform path traversal, potentially accessing or modifying files outside the intended directory. The vulnerability was reported early to the project, but no remediation or patch has been issued as of the publication date.

An attacker with local access and low privileges can exploit this vulnerability to traverse directories via the output_path argument, potentially leading to unauthorized file access or modification. The impact is limited by the requirement for local access and the absence of known remote exploitation vectors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for any updates from the vendor regarding patches or mitigations.