A path traversal vulnerability exists in WilliamCloudQi matlab-mcp-server up to commit ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca. The flaw is located in the generate_matlab_code and execute_matlab_code functions within src/index.ts of the MCP Interface component. By manipulating the scriptPath argument, an attacker can perform path traversal attacks remotely, potentially accessing unauthorized files on the server. The vulnerability is publicly known and an exploit has been published. The vendor has been informed but has not issued any response or patch as of the publication date.

Successful exploitation of this vulnerability allows remote attackers to perform path traversal, potentially accessing or manipulating files outside the intended directory scope. This could lead to unauthorized disclosure of sensitive information or modification of files on the affected system. The CVSS 4.0 score of 6.9 indicates a medium severity impact with network attack vector, no privileges or user interaction required, and low to limited confidentiality, integrity, and availability impacts.

As of now, no official patch or remediation is available from the vendor. Users should monitor the vendor's communications for updates and consider implementing network-level controls to restrict access to the vulnerable service. Avoid exposing the matlab-mcp-server to untrusted networks until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.