This vulnerability in c-rick jimeng-mcp 1.10.0 involves improper validation of the filePath argument in functions getFileContent, uploadCoverFile, generateImage, and generateVideo within src/api.ts. An attacker can exploit this flaw to perform path traversal attacks, potentially accessing files outside the intended directories. The vulnerability is remotely exploitable without requiring user interaction and has been publicly disclosed. No official patch or remediation has been released by the vendor as of the publication date.

Successful exploitation allows an attacker with limited privileges to read or manipulate files outside the intended scope by traversing directories via the filePath parameter. This can lead to unauthorized information disclosure or modification of files, impacting confidentiality and integrity. The medium CVSS score reflects the moderate risk due to the need for some privileges and the limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as input validation or restricting file path inputs to safe directories. Monitor official channels for updates and apply any official patches once available.