This vulnerability in PV-Bhat gemsuite-mcp 1.0.0 involves path traversal due to improper handling of the file_path/file_paths argument in the src/handlers/unified-gemini.ts file. The affected components include gemini_search, gemini_reason, gemini_process, and gemini_analyze. Exploitation requires local access and allows attackers to traverse directories by manipulating file path inputs. The issue was reported early but remains unpatched as of the publication date.

An attacker with local access can exploit this vulnerability to perform path traversal, potentially accessing files outside the intended directories. This could lead to unauthorized information disclosure or modification of files accessible to the application. The CVSS score of 4.8 indicates a medium severity impact with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for any suspicious activity involving file path inputs in the affected components.