This vulnerability in ezequiroga mcp-bases arises from insufficient validation of the topic argument in the search_papers function within research_server.py, enabling path traversal attacks. Such manipulation can allow attackers to access files outside the intended directory structure remotely. The vulnerability is publicly disclosed with exploit code available. Due to the rolling release approach, no fixed versions or patches have been identified or announced. No vendor advisory or remediation guidance is currently available.

Successful exploitation allows remote attackers to perform path traversal, potentially accessing unauthorized files on the server hosting the vulnerable application. This can lead to information disclosure or other impacts depending on the accessed files. The CVSS score of 6.9 (medium) reflects the network attack vector, no privileges required, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor response is available, users should monitor the project repository or issue tracker for updates. Until a fix is released, consider restricting access to the affected functionality or implementing input validation controls to mitigate path traversal risks.