An unauthenticated arbitrary file write vulnerability in dubydu sqlite-mcp allows remote attackers to overwrite files, posing a severe risk to system integrity and confidentiality.

The vulnerability exists in the extract_to_json function within src/entry.py, where the output_filename parameter fails to sanitize path traversal sequences. This allows an unauthenticated attacker to write database contents to arbitrary locations on the filesystem, provided the service account has the necessary write permissions.

The ability to write arbitrary files can lead to significant business disruption, including the unauthorized disclosure of database contents and the potential overwriting of critical system or application configuration files. While the CVSS score is 7.3, the potential for unauthorized data extraction and system manipulation warrants high priority for remediation. Successful exploitation could result in full loss of confidentiality for the database and potential loss of system integrity.

Immediate Action: Apply the vendor-provided patch (commit a5580cb992f4f6c308c9ffe6442b2e76709db548) to the sqlite-mcp repository immediately.

Proactive Monitoring: Monitor filesystem access logs for suspicious write operations originating from the sqlite-mcp service account, particularly targeting directories outside the intended database storage path.

Compensating Controls: Deploy a Web Application Firewall or similar network security appliance to inspect and block incoming JSON-RPC calls that contain path traversal sequences (such as "../") within the output_filename parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the researcher write-up linked in the vulnerability references.

Given the availability of a public proof-of-concept and the ease of triggering this vulnerability via unauthenticated JSON-RPC calls, organizations using sqlite-mcp should treat this as a high-priority issue. Administrators must apply the referenced security patch immediately to close the path traversal vector. If patching is not immediately feasible, restrict access to the MCP server to trusted internal networks and enforce the principle of least privilege on the service account running the application.