The vulnerability in mcp-memory-keeper (before 0.13.0) involves improper limitation of pathname to a restricted directory (CWE-22). The context_import function in src/index.ts uses fs.readFileSync on a caller-controlled filePath without path restriction, enabling directory traversal via '../' or absolute paths. This allows reading arbitrary files readable by the server process. Valid JSON files are parsed and imported into the caller's session, exposing their full contents through context_get or context_export. For non-JSON files, JSON.parse errors may leak leading file bytes in error messages (CWE-209). This can disclose sensitive data such as exported sessions, credentials, environment variables, and SSH key fragments. The vulnerability is fixed in version 0.13.0.

An attacker or a malicious LLM agent can exploit this vulnerability to read arbitrary files on the server running mcp-memory-keeper, potentially exposing sensitive information including credentials, service account files, environment variables, and SSH keys. The vulnerability does not allow code execution or denial of service but results in confidentiality loss. The CVSS 3.1 base score is 6.2 (medium severity), reflecting local attack vector with low complexity and no privileges required.

Upgrade mcp-memory-keeper to version 0.13.0 or later, where the vulnerability is fixed by restricting file path access in context_import. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 0.13.0.