The flaw resides in the _validate_file_path function of mcp-text-editor, which fails to constrain file names to a designated directory. This CWE-22 path traversal weakness allows a remote user to craft a file_path that climbs outside the intended directory, potentially enabling reading or overwriting of arbitrary files on the host system. The vulnerability can be triggered through input parameters sent by a client, giving remote attackers the opportunity to compromise file confidentiality and integrity.

The issue affects tumf's mcp-text-editor product up to and including version 1.0.2. Any installation that has not been upgraded beyond that release is vulnerable, regardless of the operating system or deployment configuration.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Though publicly disclosed, the lack of a known exploit and the very low EPSS make widespread exploitation unlikely at present; however, the remote trigger possibility underscores the need for timely remediation.