The duartium papers-mcp-server contains a path traversal vulnerability in the search_papers function of src/main.py. By manipulating the 'topic' parameter, an attacker can traverse directories and potentially access unauthorized files on the server. This vulnerability is remotely exploitable without requiring privileges or user interaction. The project was notified early but has not issued a fix or official response. No patch or mitigation guidance is currently available from the vendor. The CVSS 4.0 score is 6.9, indicating medium severity.

Successful exploitation of this vulnerability allows an attacker to read arbitrary files on the server by traversing the file system via the 'topic' parameter. This can lead to unauthorized disclosure of sensitive information. There is no indication of privilege escalation or code execution from the available data. No known active exploitation has been reported.

No official fix or patch is currently available from the vendor, and the project has not responded to the issue report. Users should monitor the vendor's channels for updates and consider implementing access controls or input validation at the application or network level to restrict access to the vulnerable functionality. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.