This vulnerability in florensiawidjaja BioinfoMCP up to commit 7ada7918b9e515604d3c0ae264d3a9af10bf6e54 allows remote attackers to perform path traversal via manipulation of the 'Name' argument in the Upload function located in bioinfo_mcp_platform/app.py. The issue enables unauthorized access to files outside the intended directory. The project employs continuous delivery with rolling releases, complicating version tracking. The vendor has not issued a response or patch despite early notification. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to access or overwrite files on the server by traversing directories via the upload endpoint. This could lead to unauthorized disclosure or modification of sensitive data. However, the impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes have been published, users should monitor the vendor's project repository or advisory channels for updates. In the meantime, consider implementing application-level controls such as input validation or restricting upload paths as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.