This vulnerability in handwriting-ocr-mcp-server 0.1.0 allows an attacker with local access to manipulate the File argument passed to fs.readFileSync in the upload_document component, resulting in path traversal. This can potentially allow reading arbitrary files on the system accessible to the application. No official remediation or patch has been published, and the vendor has not responded to the issue report as of the publication date.

An attacker with local access can exploit this vulnerability to read arbitrary files on the host system by manipulating the file path argument. This could lead to unauthorized disclosure of sensitive information accessible by the application. Remote exploitation is not possible as local access is required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released and the vendor has not responded, users should restrict local access to trusted users only and monitor for any updates from the vendor regarding a fix.