Threats tagged 'ghsa-r4mm-g464-9mwv'

A path traversal vulnerability exists in Dayoooun hwpx-mcp version 0.2.0 affecting the MCP Interface component, specifically the save_document/export_to_text/export_to_html functions. Manipulating the output_path argument can lead to unauthorized file system access. Remote exploitation is possible, and public exploit code is available. The project has been informed but has not yet responded or issued a fix.