This vulnerability in ZachHandley ZMCPTools (up to version 0.2.2) involves improper handling of the dirname argument in the MCP Log Resource Handler component (src/managers/ResourceManager.ts). An attacker can manipulate this argument to perform path traversal, potentially accessing files outside the intended directory. The vulnerability is remotely exploitable and has been publicly disclosed. No official patch or remediation has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker with low privileges to traverse directories and access files outside the intended scope of the application. This could lead to unauthorized disclosure of sensitive information or other impacts depending on the files accessed. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited scope and impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as input validation or restricting access to the affected component until an official fix is available.