Threats tagged 'ghsa-3qf2-rwjx-7jf5'

A path traversal vulnerability exists in ravenwits mcp-server-arangodb up to version 0.4.7 in the arango_backup function of src/tools.ts. This flaw allows remote attackers with low privileges to manipulate the outputDir argument, potentially leading to unauthorized file system access. The vulnerability has a CVSS score of 6.3 (medium severity) and public exploit details have been disclosed. The project has been notified but has not yet responded or issued a fix.