A critical path traversal vulnerability in ezequiroga mcp-bases allows unauthenticated remote attackers to perform unauthorized file system operations, posing a significant risk to system integrity.

The vulnerability exists in the search_papers function within research_server.py, where user-supplied topic strings are insufficiently sanitized before being used to construct filesystem paths. An unauthenticated attacker can supply traversal sequences (e.g., ../) to escape the designated data directory, resulting in arbitrary directory creation and the overwriting of JSON configuration files.

Successful exploitation grants an attacker the ability to write files to arbitrary locations on the host filesystem with the permissions of the application process. This can lead to unauthorized modification of critical system files, potential service disruption, or the preparation for further attacks. Although the CVSS score is 7.3, the ability to perform unauthenticated file writes makes this a high-priority risk for any environment where this tool is deployed.

Immediate Action: As no official patch is currently available, administrators should restrict access to the MCP server to trusted users only and implement strict input validation to reject any topic strings containing path separators or traversal tokens.

Proactive Monitoring: Review application logs for anomalous requests to the search_papers endpoint, specifically looking for inputs containing directory traversal characters such as dots and slashes.

Compensating Controls: Deploy a Web Application Firewall or an API gateway policy to intercept and block incoming requests containing path traversal sequences directed at the MCP service.

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher write-up at the referenced GitHub repository.

Given the availability of a public proof-of-concept and the lack of a vendor-provided fix, this vulnerability presents a clear and present danger to affected systems. Organizations must prioritize restricting access to the vulnerable component immediately and monitor for unauthorized file system modifications until an official update is released by the maintainers.