This vulnerability in Dayoooun hwpx-mcp 0.2.0 allows remote attackers to manipulate the output_path argument in certain MCP Interface functions, leading to path traversal. This can enable attackers to access or overwrite files outside the intended directory structure. The vulnerability is present in the save_document/export_to_text/export_to_html functions within the mcp-server/src/index.ts file. The project has been informed but has not issued a patch or official remediation. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow an attacker to read or write files outside the intended directories on the affected system, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and the lack of user interaction, but the vulnerability does not include scope or confidentiality/integrity/availability impacts beyond low levels as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing temporary mitigations such as restricting access to the vulnerable functions, validating and sanitizing the output_path input to prevent path traversal, or isolating the service in a restricted environment until an official patch is available.