This vulnerability in ggerve coding-standards-mcp involves improper validation of the Language argument in the get_style_guide and get_best_practices functions within server.py, enabling remote attackers to perform path traversal attacks. This can allow unauthorized access to files outside the intended directory. The project uses rolling releases, so version-specific details for affected or patched releases are unavailable. The vulnerability was disclosed publicly with an exploit available, but no vendor response or remediation has been provided as of the publication date.

Successful exploitation allows remote attackers to perform path traversal, potentially accessing unauthorized files on the server. The CVSS score of 6.9 reflects a medium severity impact with network attack vector, low complexity, no privileges or user interaction required, and low confidentiality impact. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or provided a fix, users should monitor the project repository or issue tracker for updates. Until a fix is available, consider restricting access to the affected functions or implementing input validation controls to mitigate path traversal risks.