Threats tagged 'ghsa-76pc-mqxp-3rq5'

Token Optimizer MCP version prior to 5.1.0 contains an unauthenticated path traversal vulnerability in its dashboard session log API endpoints (/api/session-summary and /api/session-events). The endpoints accept a sessionId parameter that is directly concatenated into a filesystem path without proper sanitization, allowing attackers to read arbitrary .jsonl files on the server. This can expose sensitive session log data. The vulnerability has a CVSS score of 5.3 (medium severity) and is fixed in version 5.1.0.