This vulnerability exists in the create_csv_export function of the CSV Export component (services/csv-export-service/app/api/v1/endpoints/csv_export.py) in ghantakiran splunk-mcp-integration up to commit 0b86b09d5e5adf0433acd43c975951224613a1a6. By manipulating the job_name argument, an attacker can perform path traversal, potentially accessing files outside the intended directory. The vulnerability can be exploited remotely without authentication or user interaction. The project was notified early but has not yet responded or provided a fix. Due to the continuous delivery model, no specific patched versions are currently available.

Successful exploitation of this vulnerability could allow an attacker to read or write files outside the intended directory structure on the affected system by leveraging path traversal through the job_name parameter. This could lead to unauthorized access to sensitive files or data manipulation. However, no known exploits in the wild have been reported, and the impact is rated medium severity with a CVSS 4.0 score of 6.9.

Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. Until a fix is available, restrict access to the vulnerable service and validate or sanitize inputs to the create_csv_export function if possible to mitigate path traversal risks.