A path traversal vulnerability exists in mkdocs-mcp-plugin up to version 0.4.1 in the read_document and list_documents functions of server.py. This flaw allows remote attackers to manipulate file path arguments to access unauthorized files. The vulnerability has a high severity score of 7.3 and public exploit code is available. The vendor has acknowledged the issue and plans to release a fix soon.