Deepractice PromptX versions 2.0 through 2.4.0 contain an absolute path traversal vulnerability in the Document File Handler component's file reading functions. By manipulating the argument path, an attacker can remotely access files outside the intended directories. The vulnerability is present in the source file packages/mcp-office/src/index.ts. Although publicly disclosed, no official remediation or patch has been issued by the vendor as of the publication date.

Successful exploitation of this vulnerability allows remote attackers to read arbitrary files on the affected system by bypassing intended file path restrictions. This could lead to unauthorized disclosure of sensitive information. There is no indication of privilege escalation, denial of service, or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider restricting access to the affected functions or limiting exposure of the vulnerable service until an official patch is available.