A path traversal vulnerability in the douinc mkdocs-mcp-plugin allows unauthenticated remote attackers to access unauthorized files, posing a significant risk to data confidentiality.

This is a path traversal vulnerability (CWE-22) residing in the server.py file. It allows an unauthenticated remote attacker to manipulate the docs_dir or file_path arguments to access files outside of the intended directory structure.

The ability for an unauthenticated attacker to perform path traversal can lead to the unauthorized exposure of sensitive configuration files, source code, or internal system data. With a CVSS score of 7.3, this vulnerability represents a high-risk security flaw that could facilitate further reconnaissance or compromise the integrity of the hosting environment.

Immediate Action: As there is currently no official patch available, administrators should restrict network access to the affected service or disable the plugin until the vendor releases a secure update.

Proactive Monitoring: Monitor server access logs for anomalous requests containing path traversal patterns, such as sequences of dot-dot-slash (../) characters targeting the plugin endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests that attempt to traverse directories via input parameters within the mkdocs-mcp-plugin endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up in the linked GitHub issue (https://github.com/douinc/mkdocs-mcp-plugin/issues/6).

This vulnerability is serious due to its unauthenticated nature and the presence of a public proof-of-concept. Organizations utilizing the mkdocs-mcp-plugin should prioritize mitigating this risk by limiting exposure, as the vendor fix is still pending. Once the vendor releases the update, it must be applied immediately to restore a secure posture.