This vulnerability affects Handwriting-OCR handwriting-ocr-mcp-server version 0.1.0. It arises from improper validation of the file argument passed to the fs.readFileSync function in the upload_document component's src/index.ts file. By manipulating this argument, a local attacker can perform path traversal attacks, potentially reading files outside the intended directory. The vulnerability requires local access to exploit and has a CVSS 4.8 (medium) severity rating. No official patch or remediation guidance has been published by the vendor as of the publication date.

An attacker with local access can exploit this vulnerability to read arbitrary files on the system by manipulating the file path argument, potentially exposing sensitive information. The impact is limited by the requirement for local access and the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for any updates from the vendor regarding patches or mitigations.