The vulnerability exists in ruvnet sublinear-time-solver 1.5.0 in the export_state function of src/consciousness-explorer/mcp/server.js. It allows remote attackers to perform path traversal attacks by manipulating file paths, potentially leading to unauthorized file access. The vulnerability was reported early to the project, but no response or fix has been provided. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with limited impact on confidentiality and availability.

Successful exploitation could allow an attacker to access files outside the intended directory structure on the affected system, potentially exposing sensitive information. The impact is rated medium due to the limited scope of confidentiality and availability impacts and the lack of privilege requirements for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as restricting access to the vulnerable component, validating and sanitizing input paths, or isolating the affected service until an official fix is available.