This vulnerability involves a path traversal flaw in donchelo processing-claude-mcp-bridge up to commit e017b20a4b592a45531a6392f494007f04e661bd. The flaw exists in an unknown function within processing_server.py of the create_sketch tool, where manipulation of the sketch_name argument can lead to unauthorized file path access. Remote exploitation is possible without authentication or user interaction. The vulnerability has been publicly disclosed with available exploit code. Due to the rolling release nature of the project, specific affected or fixed versions are not enumerated. The vendor has not yet issued a response or patch.

Successful exploitation allows remote attackers to perform path traversal, potentially accessing or manipulating files outside intended directories. This could lead to unauthorized disclosure or modification of files. The CVSS score of 6.9 indicates a medium severity impact with low vector complexity and no required privileges or user interaction. There is no indication of further privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor the project repository and issue tracker for updates. Until a patch is available, restrict network access to the vulnerable service and consider implementing application-layer controls to validate or sanitize the sketch_name input to mitigate exploitation risk.