This vulnerability in ef10007 MLOps_MCP 1.0.0 involves a path traversal issue in the save_file tool's fastmcp_server.py component. By manipulating the filename or destination argument, an unauthenticated remote attacker can traverse directories outside the intended path. The vulnerability is publicly disclosed with exploit code available, but no official fix or vendor response has been provided. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector and no privileges or user interaction required.

Successful exploitation allows remote attackers to perform path traversal, potentially leading to unauthorized access or modification of files outside the designated directory. This could compromise system integrity or confidentiality depending on the files accessed. There are no confirmed reports of exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. The vendor has not responded to the issue report. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict network access to the affected service and consider implementing compensating controls such as input validation or file system access restrictions if feasible.