Dayoooun hwpx-mcp 0.2.0 contains a path traversal vulnerability in the MCP Interface component's save_document, export_to_text, and export_to_html functions within mcp-server/src/index.ts. Manipulating the output_path argument enables an attacker to traverse directories and potentially write files outside intended locations. Remote exploitation is possible without user interaction. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). The vendor has not issued a patch or official remediation as of the published date.

Successful exploitation allows an attacker with low privileges to perform path traversal via the output_path argument, potentially leading to unauthorized file writes or overwrites outside the intended directory. This could compromise system integrity or availability depending on the files affected. The vulnerability is remotely exploitable without user interaction, increasing risk. However, the impact is rated medium due to limited scope and required privileges.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided a fix, users should consider implementing manual input validation or sanitization of the output_path argument to prevent path traversal. Monitor vendor advisories for updates and apply official patches promptly once released. Avoid exposing the vulnerable service to untrusted networks until remediation is available.