This vulnerability in eiceblue spire-doc-mcp-server 1.0.0 allows an unauthenticated remote attacker to perform path traversal by manipulating the document_name parameter in the get_doc_path function. This can lead to unauthorized access to files outside the intended directory. The vulnerability is confirmed and publicly disclosed with a CVSS 4.0 score of 6.9 (medium severity). No official fix or remediation guidance has been published by the vendor as of the latest information.

Successful exploitation could allow an attacker to read arbitrary files on the server by traversing directories via the manipulated document_name argument. This may lead to information disclosure depending on the server's file permissions and contents accessible to the application process. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as input validation or restricting access to the affected service until an official patch is available.