A path traversal vulnerability exists in @puchunjie/doc-tools-mcp version 1.0.18 and earlier. The flaw is in the create_document/open_document functions of src/mcp-server.ts, where manipulation of the filePath argument allows remote attackers to access unauthorized file system locations. Public exploit code is available, but no official patch or vendor response has been issued yet. The vulnerability has a medium severity rating with a CVSS score of 6.3.