The vulnerability exists in the create_file function within app/api/mcp/route.ts of the 03-lovepreetSingh MCP project up to commit f95d035c5317fad81af9828286631053ccb23546. It allows remote attackers to perform path traversal by manipulating the filePath or content arguments, potentially leading to unauthorized file access. The project does not use versioning, so affected versions cannot be precisely identified. The issue was reported early to the project but remains unaddressed. An exploit is publicly available, but no evidence of active exploitation in the wild is reported.

Successful exploitation can lead to unauthorized access to files outside the intended directory, which may expose sensitive information or allow further attacks. The vulnerability is remotely exploitable without authentication, increasing risk. However, no confirmed active exploitation is known at this time.

No official fix or patch is currently available. Users should monitor the project for updates or advisories. Until a fix is released, restricting access to the vulnerable functionality or implementing external controls to validate and sanitize file path inputs may reduce risk. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance.