Deepractice PromptX up to version 2.4.0 contains an absolute path traversal vulnerability in the Document File Handler component, specifically in functions read_docx, read_xlsx, read_pptx, list_xlsx_sheets, and read_pdf within packages/mcp-office/src/index.ts. This flaw allows remote attackers to manipulate the argument path to access arbitrary files on the system. The vulnerability was publicly disclosed and reported early to the project, but no remediation or patch has been provided as of the publication date.

An attacker can remotely exploit this vulnerability to perform absolute path traversal, potentially accessing sensitive files on the affected system. There is no indication of privilege escalation or code execution from the provided data. The vulnerability's medium severity reflects the potential for unauthorized file access without requiring user interaction or privileges.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates and consider restricting network access to the affected service or implementing application-level controls to validate and sanitize file path inputs until a patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.