The dashboard HTTP server in @ooples/token-optimizer-mcp (version 5.0.1) exposes two API endpoints that accept a sessionId parameter which is concatenated unsafely into a filesystem path using path.join. Node.js normalizes '..' sequences, enabling unauthenticated attackers to perform path traversal and read arbitrary .jsonl files outside the intended directory. Both /api/session-summary and /api/session-events endpoints are affected. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Proof of concept demonstrates reading files outside the hooksDataPath directory without credentials. The vulnerability allows disclosure of potentially sensitive session log data.

An unauthenticated remote attacker can read any .jsonl file accessible to the server process by exploiting path traversal via the sessionId parameter. This can expose sensitive operational data contained in session logs and other .jsonl files reachable from the hooksDataPath directory. The attack does not allow modification or deletion of files, only read access. The lack of authentication on these endpoints increases the risk of unauthorized data disclosure.

A patch is available for this vulnerability. The vendor recommends validating the sessionId parameter against a strict allowlist regex to exclude path traversal characters, or alternatively using path.basename to sanitize the input before path joining. Additionally, authentication middleware should be added to all /api/* routes to prevent unauthenticated access. Applying these mitigations will prevent unauthorized file reads via path traversal.