mcpo-simple-server versions up to 0.2.0 contain a path traversal vulnerability in the delete_shared_prompt function. This flaw allows remote attackers to manipulate file paths via the detail argument, potentially accessing or modifying unintended files. Public exploit code is available, but no official patch or response from the project has been issued yet.