This vulnerability affects Flux159 mcp-game-asset-gen 0.1.0 in the image_to_3d_async function of src/index.ts. An attacker can manipulate the statusFile argument to achieve path traversal, potentially accessing unauthorized files on the system. The attack vector is remote with no required privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity. The vendor has been informed but has not issued a fix or advisory, and no patch links are available.

Successful exploitation allows an unauthenticated remote attacker to perform path traversal via the statusFile argument, potentially leading to unauthorized file access. The vulnerability has a medium severity score (CVSS 6.9) with low confidentiality, integrity, and availability impacts. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying manual mitigations such as input validation or restricting file system access for the affected component until an official patch is available.