The douinc mkdocs-mcp-plugin up to version 0.4.1 contains a path traversal vulnerability in the read_document and list_documents functions of server.py. By manipulating the docs_dir or file_path parameters, an attacker can remotely traverse directories outside the intended scope, potentially accessing sensitive files. The vulnerability is confirmed by the vendor, who plans to release a fix shortly. Currently, no official patch or remediation is available, and the exploit has been publicly disclosed.

Successful exploitation allows remote attackers to perform path traversal, potentially reading arbitrary files on the server hosting the mkdocs-mcp-plugin. This could lead to unauthorized disclosure of sensitive information. The CVSS score of 6.9 indicates a medium severity impact with no required privileges or user interaction for exploitation.

No official fix or patch is currently available. The vendor has confirmed that a fix will be published within a few days. Until then, users should consider restricting access to the affected plugin or implementing network-level controls to limit exposure. Monitor the vendor advisory for the official patch and apply it promptly once released.