An unknown function in src/tools/ludusEnvironmentGuidesSearch.ts of NocteDefensor LudusMCP allows manipulation of the guide_name argument to perform a path traversal attack. The exploitation grants the attacker read or write access to arbitrary files relative to the application’s directory structure. Because the vulnerability requires a locally authenticated user, it can be employed by insiders or by an application running with elevated privileges to compromise confidentiality, integrity, or availability of the file system.

NocteDefensor LudusMCP versions up to 1.0.24 are affected. The vulnerability is present in the ludus_environment_guides_search component within the ludusEnvironmentGuidesSearch.ts file.

The CVSS score of 4.8 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation activity in the wild. The attack vector is local; an attacker must have local system access and the appropriate permissions to leverage the path traversal capability. No public exploit has been documented publicly. The risk is thus confined to environments where local users are able to run the application with sufficient privileges.