This vulnerability exists in 8nite metatrader-4-mcp 1.0.0 within the CallToolRequestSchema function of src/index.ts in the sync_ea_from_file component. By manipulating the ea_name parameter, an attacker can perform a path traversal attack remotely, potentially accessing files outside the intended directory. The issue was reported early to the project but remains unpatched as of the publication date. No official remediation or patch is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to read or access files outside the intended directory structure on the affected system, potentially exposing sensitive information or configuration files. The attack requires no user interaction and can be performed remotely. The overall impact is rated medium based on the CVSS score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing access controls or input validation to restrict or sanitize the ea_name parameter to mitigate potential exploitation until an official patch is released.