This vulnerability in PV-Bhat gemsuite-mcp 1.0.0 involves path traversal due to improper validation of the file_path/file_paths argument in the src/handlers/unified-gemini.ts file. The affected components include gemini_search, gemini_reason, gemini_process, and gemini_analyze. Exploitation requires local access and allows an attacker to manipulate file paths to access files outside the intended directory scope. The issue was reported early to the project, but no remediation or patch has been provided as of the publication date.

An attacker with local access can exploit this vulnerability to perform path traversal, potentially accessing or manipulating files outside the intended directories. This could lead to unauthorized information disclosure or modification of files accessible by the application. However, remote exploitation is not possible, limiting the attack surface to local users with some level of privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for any suspicious local activity involving the affected components until an official fix is available.