This vulnerability involves a path traversal issue in NocteDefensor LudusMCP up to version 1.0.24. Specifically, an unknown function in the file src/tools/insertCredsRangeConfig.ts within the insert_creds_range_config component improperly handles the configPath and outputPath arguments, allowing an attacker with local access to traverse directories outside the intended scope. The vulnerability was reported early to the project, but no official remediation or patch has been released at this time.

An attacker with local access and low privileges can exploit this vulnerability to perform path traversal, potentially accessing or modifying files outside the intended directories. The impact is limited by the requirement for local execution and low privileges, resulting in a medium severity rating with a CVSS score of 4.8. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted users only and monitor for any updates from the vendor regarding patches or mitigations.