This vulnerability involves a path traversal issue in the handleInitializeMemoryBank function of the dazeb cline-mcp-memory-bank component. By manipulating the projectPath argument, an attacker can traverse directories outside the intended scope. The vulnerability is remotely exploitable and a public exploit is available. Due to the rolling release model, version details for affected or patched releases are not specified. The vendor has not issued any advisory or patch at this time.

Successful exploitation allows an attacker to access files outside the intended directory structure, potentially leading to unauthorized information disclosure or further system compromise. The vulnerability is remotely exploitable without user interaction and has a medium CVSS score of 5.3. No known exploits in the wild have been reported beyond the public exploit release.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the affected functionality or applying environment-level controls to limit path traversal impact.