This vulnerability affects the delete_shared_prompt function in src/mcpo_simple_server/services/prompt_manager/base_manager.py of getsimpletool mcpo-simple-server versions 0.1 and 0.2.0. The issue is a relative path traversal caused by improper validation of the 'detail' argument, enabling remote attackers to access or delete files outside the intended directory scope. The vulnerability is remotely exploitable without authentication or user interaction. The project was notified early but has not provided a fix or mitigation guidance. No official patch or workaround is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform unauthorized file system operations by traversing directories outside the intended path. This may lead to deletion or manipulation of arbitrary files on the server running the affected software. The CVSS 4.0 score of 6.9 reflects a medium severity impact with low complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider restricting network access to the affected service and monitor for suspicious activity related to file operations. Avoid exposing the mcpo-simple-server to untrusted networks until a patch or official mitigation is available.