This vulnerability involves a path traversal issue in the handleInitializeMemoryBank function of the dazeb cline-mcp-memory-bank component. By manipulating the projectPath parameter, an attacker can traverse directories outside the intended scope. The vulnerability is remotely exploitable and a public exploit exists. Due to the rolling release model, no fixed version has been identified, and the vendor has not provided a response or patch as of the publication date.

Successful exploitation of this vulnerability allows an attacker to access files and directories outside the intended project path, potentially exposing sensitive information or enabling further attacks. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed, but with low confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should monitor official channels for updates. Until a fix is released, restricting access to the affected service and validating or sanitizing input parameters where possible may reduce exposure.