An unauthenticated path traversal vulnerability in the duartium papers-mcp-server allows remote attackers to perform unauthorized file operations, posing a significant risk to system integrity.

The search_papers tool in src/main.py fails to sanitize the topic argument, which is used to construct a directory path. An unauthenticated attacker can supply traversal sequences to escape the intended storage directory and create or overwrite files elsewhere on the filesystem.

The ability for an unauthenticated user to write or overwrite arbitrary JSON files can lead to unauthorized configuration changes, potential application compromise, or service disruption. Given the CVSS score of 7.3, this flaw represents a high risk to business operations, as it allows remote attackers to bypass intended storage boundaries and manipulate application-critical data.

Immediate Action: As no official patch is currently available, users should restrict access to the MCP server endpoint to trusted networks only and run the service under a strictly sandboxed, low-privilege user account.

Proactive Monitoring: Review filesystem logs for suspicious directory creation attempts or file modification events originating from the papers-mcp-server service process.

Compensating Controls: Implement input validation at the gateway level to reject any request containing directory traversal sequences, such as dot-dot-slash patterns, before they reach the application logic.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided in the referenced GitHub issue.

This vulnerability is highly concerning due to the lack of input sanitization and the ease of exploitation via simple JSON-RPC calls. Security teams must treat this as a priority and restrict network access to the service immediately while awaiting a formal vendor update. Once a patch is released, it should be deployed as soon as testing confirms stability.