This vulnerability affects Flux159 mcp-game-asset-gen 0.1.0 in the image_to_3d_async function of src/index.ts. An attacker can manipulate the statusFile parameter to perform path traversal, potentially accessing unauthorized files on the system. The vulnerability is remotely exploitable without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to low integrity and availability impact. No official remediation or patch has been provided by the vendor, and the project has not responded to the initial report. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker to read or write files outside the intended directory by traversing the file system via the statusFile argument. This may lead to unauthorized disclosure of sensitive information or modification of files, impacting system integrity and availability to a limited extent. The CVSS score of 6.9 reflects a medium severity level with potential partial impact on confidentiality, integrity, and availability.

As of the current information, no official fix or patch is available from the vendor. Users should monitor the vendor's communications for updates or patches. In the meantime, restricting access to the vulnerable service and validating or sanitizing inputs to the statusFile parameter at the application or network level may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.