This vulnerability in ZachHandley ZMCPTools (up to version 0.2.2) involves improper handling of the dirname argument in the MCP Log Resource Handler component's ResourceManager.ts file. An attacker can manipulate this argument to perform path traversal, potentially accessing files outside the intended directory scope. Remote exploitation is possible, and the vulnerability has been publicly disclosed. The project has been notified but has not issued a patch or official remediation.

Successful exploitation of this vulnerability allows an attacker with low privileges to perform path traversal, potentially accessing or manipulating files outside the intended directory structure. This could lead to unauthorized information disclosure or modification of files. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor the vendor's channels for updates. Until a fix is released, restrict access to the affected component and validate or sanitize inputs to the dirname argument where possible to mitigate exploitation risk.