This vulnerability in huangjunsen0406 xiaozhi-mcphub (up to version 1.0.3) involves a path traversal flaw due to insufficient validation of the manifest.name argument in the src/controllers/dxtController.ts source file. An attacker can remotely manipulate this argument to traverse directories and potentially access unauthorized files. The vulnerability is publicly known and exploitable, but no official patch or remediation has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to access files outside the intended directory structure, potentially exposing sensitive information or enabling further attacks depending on the file contents accessed. The CVSS 4.0 score of 5.3 indicates a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. However, the overall impact is limited by the lack of privilege escalation or integrity/confidentiality impact beyond the path traversal itself.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, restricting access to the affected application and implementing network-level controls to limit exposure may reduce risk. Avoid exposing the vulnerable service to untrusted networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.