This vulnerability exists in debugmcp mcp-debugger versions up to 0.20.0 in the handleGetSourceContext function of src/server.ts. It allows remote attackers to perform path traversal by manipulating input parameters, potentially accessing files outside the intended directory scope. The vulnerability does not require privileges or user interaction and has a CVSS 4.0 score of 5.3 (medium severity). There is no vendor response or patch available at this time.

An attacker can remotely exploit this vulnerability to access files on the affected system that should be restricted, which may lead to information disclosure. The vulnerability does not require privileges or user interaction, increasing its risk. However, the impact is limited by the scope of accessible files and the absence of privilege escalation or code execution in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting network access to the mcp-debugger service and monitor for suspicious activity related to file access attempts. Avoid exposing the service to untrusted networks until a fix is released.