This vulnerability in xiaozhi-mcphub (up to version 1.0.3) involves a path traversal issue caused by manipulation of the manifest.name argument in the source file src/controllers/dxtController.ts. The flaw allows remote attackers to influence file path resolution, potentially accessing unauthorized files. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The vendor has not provided a remediation or patch, and the project has not responded to the issue report.

Successful exploitation could allow an attacker to read or access files outside the intended directory structure, potentially exposing sensitive information or enabling further attacks. The impact is assessed as medium severity with limited confidentiality, integrity, and availability impact. No known active exploitation has been reported.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the project repository or vendor advisories for updates. Until a patch is released, consider restricting access to the affected application and validating or sanitizing input parameters at the application or network level to mitigate exploitation risk.