The vulnerability CVE-2026-7645 exists in ruvnet sublinear-time-solver 1.5.0 within the export_state function of the MCP Interface component. It is a path traversal issue that can be triggered remotely without authentication or user interaction. This allows an attacker to manipulate file paths to access files outside the intended directory scope. The vulnerability was reported early to the project, but no official remediation or patch has been released as of the publication date. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with limited confidentiality and availability impact.

Successful exploitation of this vulnerability could allow an attacker to read or access files on the affected system that should be restricted, potentially leading to information disclosure or further system compromise. The attack can be performed remotely without authentication, increasing the risk. However, the impact is limited to confidentiality and availability with no integrity impact indicated.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor the vendor's communications for updates and consider implementing network-level protections such as restricting access to the affected service until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.