This vulnerability affects ravenwits mcp-server-arangodb versions 0.4.0 through 0.4.7. The arango_backup function improperly validates the outputDir parameter, enabling an attacker to traverse directories on the server file system. The vulnerability is remotely exploitable and does not require user interaction or elevated privileges beyond low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor has not yet issued a patch or official remediation guidance.

Successful exploitation allows an attacker to access or write files outside the intended directory structure on the server hosting mcp-server-arangodb. This could lead to unauthorized disclosure or modification of files, potentially impacting system integrity and confidentiality. The vulnerability is exploitable remotely and does not require user interaction, increasing its risk. However, the overall impact is limited by the need for low privileges and the lack of evidence of exploitation in the wild.

No official patch or remediation has been released by the vendor as of the current information. Users should monitor the vendor's communications for updates. Until a fix is available, restricting network access to the affected service and validating or sanitizing input parameters where possible may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.