This vulnerability exists in the Upload endpoint of the BioinfoMCP application, specifically in the file bioinfo_mcp_platform/app.py. By manipulating the 'Name' parameter, an attacker can perform path traversal, potentially accessing or overwriting files outside the intended directory. The vulnerability can be exploited remotely without authentication. The product uses continuous delivery with rolling releases, complicating version tracking and patch availability. The project maintainers have been informed but have not yet responded or issued a fix. No official remediation or patch is currently documented.

Successful exploitation of this vulnerability could allow an attacker to read or write files outside the intended upload directory, potentially leading to unauthorized access or modification of sensitive files. The CVSS score of 6.9 indicates a medium severity impact with network attack vector and no required privileges or user interaction. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor the project repository or official channels for updates. Until a fix is available, consider restricting access to the upload functionality or implementing additional input validation and sanitization on the 'Name' parameter to mitigate path traversal risks.